review

Type	Skill
Plugin	awl-general · v0.0.51
Invoke	/awl-general:review
Tools	Read, Glob, Grep, Task, Bash
Source	plugins/awl-general/skills/review/SKILL.md

When Claude uses it

Review code for bugs, security issues, and best practices. Growing knowledge base of common mistakes and review patterns across frameworks. Triggers on ‘review’, ‘code review’, ‘check code’, ‘audit’, ‘find bugs’.

Definition

Review checklist that grows over time. The CodeReviewer agent references this skill automatically. Each section covers framework-specific pitfalls learned from real projects.

---

Payload CMS — Access Control

Common Mistakes

Mistake	Impact
Making data available publicly	Data leak — unauthenticated users see everything
Writable for all authenticated users (anyone can sign up)	Unauthorized writes — any account can modify data
User can change own role/permission fields	Privilege escalation
Exposing sensitive data (API keys, secrets) in responses	Credential leak

Collections / Globals

Field-based permissions matter. Granting read or update on a collection gives access to ALL fields unless field-level access control is set.

Checklist:

• Protect permission-related fields (isAdmin, role, paidForPremiumPlan) — users MUST NOT increase their own permissions
• Remove read access to sensitive fields (API keys, 2FA secrets, tokens)
• Use field-level access control, not just collection-level
• Review ALL collection access configs — don’t blindly trust generated code

Custom Endpoints

Custom endpoints are publicly available by default. You MUST implement access checks.

// BAD — no auth check
app.get("/api/custom", async (req, res) => {
  const data = await payload.find({ collection: "secrets" });
  res.json(data);
});

// GOOD — check authenticated user
app.get("/api/custom", async (req, res) => {
  if (!req.user) {
    return res.status(401).json({ error: "Unauthorized" });
  }
  const data = await payload.find({ collection: "secrets", user: req.user });
  res.json(data);
});

Review Recommendations

1. Always review all collection access configs manually
2. Check @awl/payload-access-policies package (by Mich) for standardized patterns
3. Be aware WHO can authenticate when defining access controls
4. Claude can implement access controls correctly — but it needs to know your intentions regarding who should access what

---