security-api-files-and-realtime
Skill4 starsChanged 5 days agoMITView on GitHub
Assess and remediate api boundaries, file handling, graphql, websocket and webrtc risks in frontend and associated web services. Use for REST, GraphQL, upload, download, WebSocket, WebRTC, BOLA, file validation.
In this repository55 other files it gives its agents.
- design-balance-and-proportionSkill
- design-brand-and-art-directionSkill
- design-buildSkill
- design-color-theorySkill
- design-diagnoseSkill
- design-hierarchy-and-emphasisSkill
- design-imagery-and-textureSkill
- design-layout-and-gridSkill
- design-movement-and-flowSkill
- design-reviewSkill
- design-rhythm-and-patternSkill
- design-typographySkill
- design-unity-and-systemsSkill
- design-validateSkill
- security-authentication-and-sessionsSkill
- security-authorizationSkill
- security-browser-and-originSkill
- security-buildSkill
- security-configuration-and-secretsSkill
- security-crypto-and-dataSkill
- security-dependencies-and-buildSkill
- security-diagnoseSkill
- security-injection-and-validationSkill
- security-logging-and-failureSkill
- security-reviewSkill
- security-threat-model-and-designSkill
- security-validateSkill
- ux-accessibilitySkill
- ux-buildSkill
- ux-controls-and-inputsSkill
- ux-decisions-and-loadSkill
- ux-diagnoseSkill
- ux-feedback-and-performanceSkill
- ux-forms-and-errorsSkill
- ux-journeys-and-motivationSkill
- ux-navigation-and-structureSkill
- ux-onboarding-and-learningSkill
- ux-reviewSkill
- ux-trust-and-ethicsSkill
- ux-validateSkill
- ux-visual-hierarchySkill
- wcag-alternatives-and-mediaSkill
- wcag-assistive-tech-and-statusSkill
- wcag-buildSkill
- wcag-diagnoseSkill
- wcag-forms-and-error-preventionSkill
- wcag-keyboard-and-focusSkill
- wcag-language-and-predictabilitySkill
- wcag-navigation-and-discoverySkill
- wcag-pointer-and-touchSkill
- wcag-reviewSkill
- wcag-semantics-and-reading-orderSkill
- wcag-time-and-motionSkill
- wcag-validateSkill
- wcag-visual-and-responsiveSkill
The file
We split this skill into the rules it gives an agent
4 rules. About 0 are common, 2 are distinctive, and 2 are very specific to this project.
≈0
Common · estimate
Many files like this have a rule of this kind.
≈2
Distinctive · estimate
This author's own choices. Worth a look.
2
Very specific
Tied to their project's names, files or tools. Probably skip.
- Common
- Distinctive
- Very specific
- Very specific: line 17
Read references/playbook.md and the relevant ASVS chapter entries.
- Very specific: line 20
Test normal and denied paths with synthetic or approved fixtures, documenting exact methods and evidence.
- Distinctive: line 26
Do not send test content to production endpoints without explicit permission.
- Distinctive: line 28
No active probing of live systems, aggressive scanning, credential handling or cross-tenant requests without explicit authorization.
≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.
Files
API, file and realtime surface risks
Scope
Use when the task concerns api boundaries, file handling, graphql, websocket and webrtc risks. Common triggers include REST, GraphQL, upload, download, WebSocket, WebRTC, BOLA, file validation. Do not classify unrelated symptoms as this category or expand the authorized scope. A client-side implementation may not reveal server-side enforcement.
ASVS 5.0.0 chapters: V4, V5, V17. For exact requirement wording and levels consult ../security-diagnose/references/asvs/5.0.0/index.json and the version-pinned official ASVS source. Do not treat the index as the full standard. The local reference is references/playbook.md.
Procedure
- Establish the user action, attacker/actor, sensitive asset, trust boundary, affected runtime, and actual observed evidence.
- Read
references/playbook.mdand the relevant ASVS chapter entries. Resolve baseline using../security-diagnose/references/standard-selection.md(explicit task > project policy > planning fallback). - Differentiate the underlying cause from superficial symptoms; select a specific applicable requirement only after checking the authoritative source text.
- Implement or recommend the smallest verified control with the project’s existing security architecture. Prefer server-side enforcement when the failure crosses the browser trust boundary.
- Test normal and denied paths with synthetic or approved fixtures, documenting exact methods and evidence. Record residual unknowns; route broad assessments to
security-review, implementation tosecurity-buildand retesting tosecurity-validate.
Failure discipline
- Client-side file type hints are not security controls.
- WebSocket handshake success does not establish message-level authorization.
- Do not send test content to production endpoints without explicit permission.
No active probing of live systems, aggressive scanning, credential handling or cross-tenant requests without explicit authorization. Never report security certification from this skill alone.
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.