danygiguere

danygiguere/audit-skills

Skill Claude CodeCodex

Query-amplification (N+1) checklist. Use when code loads related data inside a loop over a collection, or when reviewing ORM-heavy read paths for performance.

danygiguere/audit-skills

Skill Claude CodeCodex

Numeric and money precision checklist. Use when code computes money, totals, taxes, or splits — float used for currency, ad hoc rounding, integer overflow, division remainders, or unit/currency mismatches.

danygiguere/audit-skills

Skill Claude CodeCodex

Observability checklist. Use when checking whether errors, slow paths, or new endpoints would be visible in production — logging, metrics, tracing, alerts.

danygiguere/audit-skills

Skill Claude CodeCodex

Output encoding and XSS checklist. Use when user-controlled data is rendered into HTML, JavaScript, CSS, URLs, headers, or emails.

danygiguere/audit-skills

Skill Claude CodeCodex

Parser/validator differential checklist. Use when reviewing validators, regexes, allowlists, URL or path parsing, content-type checks, or normalization — inputs a gate accepts but the downstream consumer interprets differently (unanchored regexes, startswith allowlists, two URL parsers, validate-then-reparse).

danygiguere/audit-skills

Skill Claude CodeCodex

Resource-exhaustion checklist. Use when reviewing endpoints for missing pagination, unbounded loops over input, missing size or rate limits, or regex backtracking.

danygiguere/audit-skills

Skill Claude CodeCodex

Database schema design checklist (indexes, foreign keys, constraints). Use when reviewing migrations, new tables or columns, slow queries, missing indexes, foreign-key and ON DELETE behavior, or integrity rules enforced only in app code.

danygiguere/audit-skills

Skill Claude CodeCodex

Secrets-handling checklist. Use when reviewing code or config touching API keys, credentials, or tokens — hardcoding, logging, committing, rotation.

danygiguere/audit-skills

Skill Claude CodeCodex

Server-side request forgery checklist (includes open redirects). Use when code makes network requests to URLs, hosts, or IPs derived from user input — webhooks, fetchers, URL previews, importers.

danygiguere/audit-skills

Skill Claude CodeCodex

Shared and concurrent state checklist. Use when reviewing code with shared mutable state, caching, counters, or check-then-act sequences (race conditions).

danygiguere/audit-skills

Skill Claude CodeCodex

Statelessness checklist for horizontally scaled apps. Use when reviewing services meant to run as multiple replicas — in-memory sessions or counters, module/static mutable state, local-disk uploads, process-local locks or schedulers, sticky-session assumptions, state lost on deploy.

danygiguere/audit-skills

Skill Claude CodeCodex

Multi-tenant isolation checklist. Use when reviewing queries, caches, or background jobs in a multi-tenant app for cross-tenant data leakage — tenant scoping, shared cache keys.

danygiguere/audit-skills

Skill Claude CodeCodex

Time, timezone, and clock-correctness checklist. Use when code stores or computes timestamps, durations, timeouts, or expiry — naive vs aware datetimes, server-local now(), wall-clock for elapsed time, DST and calendar math, cross-zone comparisons.

danygiguere/audit-skills

Skill Claude CodeCodex

Inbound token and webhook verification checklist. Use when code verifies JWTs, API keys, signed URLs, or webhook signatures — decode-without-verify, alg confusion, missing exp/aud/iss checks, kid/JWKS handling, HMAC over raw body, replay windows.

danygiguere/audit-skills

Skill Claude CodeCodex

Full security, correctness, and operability audit of code. Use when reviewing a diff, endpoint, or feature for vulnerabilities or bugs without a specific topic in mind — security review, audit, code review for safety, "check this for issues".

danygiguere/audit-skills

Instructions file CodexOpenCode

Instructions for danygiguere/audit-skills, covering engineering audit digest, invariants (always apply), access & data security, input, api & dependencies and correctness.

danygiguere/audit-skills

Instructions file

Instructions for danygiguere/audit-skills, a project described as: Language- and framework-agnostic audit checklists for AI coding agents — security, correctness, and operability. Works with Claude Code, GitHub Copilot, Cursor, Codex CLI, OpenCode, and any agent that can read files.