vajv-questionwork-admin-security-instructions.ocm.json json {
"ocm": "1",
"id": "vajv-questionwork-admin-security-instructions",
"kind": "skill",
"name": "QuestionWork Admin Security",
"description": "Use when editing admin endpoints, TOTP flows, IP allowlist logic, moderation features, auth dependencies, or security-sensitive QuestionWork code. Covers require_admin, rate limiting, auditability, and safe defaults.",
"publisher": "VajV",
"version": "1.0.0",
"capabilities": {
"domains": [
"coding"
],
"tags": [
"skill-md",
"github-instructions"
],
"languages": [
"en"
]
},
"quality_prior": 0.6,
"examples": [
"Use when editing admin endpoints, TOTP flows, IP allowlist logic, moderation features, auth dependencies, or security-sensitive QuestionWork code. Covers require_admin, rate limiting, auditability, and safe defaults."
],
"primary": false,
"metadata": {
"source": {
"provider": "github-instructions",
"repository": "https://github.com/VajV/QuestionWork",
"path": ".github/instructions/admin-security.instructions.md",
"ref": "563bcd1a53d451e1ddc9551257c225f768a56b68",
"url": "https://github.com/VajV/QuestionWork/blob/563bcd1a53d451e1ddc9551257c225f768a56b68/.github/instructions/admin-security.instructions.md",
"key": "VajV/QuestionWork/.github/instructions/admin-security.instructions.md"
}
},
"instructions": "# QuestionWork Admin Security\n\n- Admin routes should require `require_admin` and preserve existing permission boundaries.\n- Mutating admin operations still need explicit `check_rate_limit()`.\n- Preserve auditability for bans, XP grants, wallet actions, withdrawals, broadcasts, and dispute actions.\n- Treat TOTP, IP allowlist, auth cookies, JWT handling, and secret defaults as high-risk areas.\n- Prefer secure defaults over convenience defaults, especially for production-like settings.",
"cost": {
"context_tokens": 121
}
}