Loading...
Loading...
Found 5 Skills
Audit and harden authentication code for security best practices. Use when the user wants to check their auth implementation for vulnerabilities, harden session handling, fix credential storage, or apply OWASP-recommended security patterns.
Implement Cross-Site Request Forgery (CSRF) protection for API routes. Use this skill when you need to protect POST/PUT/DELETE endpoints, implement token validation, prevent cross-site attacks, or secure form submissions. Triggers include "CSRF", "cross-site request forgery", "protect form", "token validation", "withCsrf", "CSRF token", "session fixation".
Review code for Government of Canada authentication and identity management compliance. Checks OIDC implementations, session security, scope minimization, logout handling, and RBAC integration against ITSG-33 and TBS security standards.
Use when preparing a public launch of a site or app that has client and server code, environment variables, accounts, or APIs, to find launch-blocking security mistakes: exposed secrets and client-side env misuse, missing authorization on routes and APIs, publicly reachable private routes, debug endpoints, unsafe redirects and rendering, and insecure session handling. It reports evidence and fixes clear low-risk issues. Do not use it as a penetration test, to claim a site is secure, to use or rotate credentials, or to treat a hidden admin link as authorization.
Use when a Telegram job needs a user account rather than a bot token: reading history a bot cannot see, acting as a person, bulk export with Telethon or another MTProto client, and the ban risk that comes with it. Not for ordinary bots (telegram-bots) or the web layer (telegram-miniapps). Opt out: no telegram, без телеграма. Triggers - "telethon", "pyrogram", "mtproto", "userbot", "FloodWaitError", "юзербот", "мтпрото", "сессия телеграм".