awesome-leak-auditlisted

Audits a public-facing client (extension, mobile or desktop app, SPA, CLI, SDK) so its published surface reveals nothing about the private backend: leaked internals in comments, docs and tests (rate limits, anti-abuse, quotas, test backdoors, infra, schema, env-var names), plus client hardening (permissions, message-sender validation, token handling, DOM sinks, bundled secrets). Use when asked whether a repo leaks backend details, before open-sourcing or a store submission, to harden a client, or 'что раскрывает наш клиент'. Do not use for server-side vulnerability hunting (awesome-security-audit).
khasky/awesome-agent-skills · ★ 8 · Code & Development · score 78

Install: claude install-skill khasky/awesome-agent-skills

# Public Client Leak Audit Audit a public client codebase that talks to a private backend. Goal: the public surface must be *self-contained* — it may reveal the calls it makes and the data shapes it exchanges (unavoidable for any shipped client), but nothing beyond that. Every extra detail about how the server works is free reconnaissance for an attacker and a lever for abuse. This skill produces three things: a findings list (leaks + client-side security holes, each with `file:line` and severity), a set of applied fixes, and a report with residual recommendations. Reference files (load on demand — read the one you need, don't inline all of them): - [`references/leak-taxonomy.md`](references/leak-taxonomy.md) — the categories of disclosure to hunt, why each matters, and starter search patterns. - [`references/rewrite-rules.md`](references/rewrite-rules.md) — the comment/string rewrite rule with before/after examples; how to decide keep-vs-cut. - [`references/client-hardening.md`](references/client-hardening.md) — runtime-independent client-side security checklist (capabilities, cross-context entry points, tokens, network, build config, supply chain). - [`references/browser-client.md`](references/browser-client.md) — the browser half of that checklist (extension permissions, storage tiers, DOM/CSS sinks, bundler config, npm lifecycle scripts). Load it *with* `client-hardening.md` for an extension, SPA, or web SDK; skip it for a native, desktop, or CLI client. - [`references