# Tlamatini Csrf Exempt Audit

> Enumerate every @csrf_exempt-decorated view in Tlamatini/agent/views.py and classify whether each one really needs the exemption.

- **Type:** Skill
- **Install:** `agentstack add skill-xaiht-tlamatini-tlamatini-csrf-exempt-audit`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [XAIHT](https://agentstack.voostack.com/s/xaiht)
- **Installs:** 0
- **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [XAIHT](https://github.com/XAIHT)
- **Source:** https://github.com/XAIHT/Tlamatini/tree/main/Tlamatini/agent/skills_pkg/tlamatini_csrf_exempt_audit
- **Website:** https://xaiht.org

## Install

```sh
agentstack add skill-xaiht-tlamatini-tlamatini-csrf-exempt-audit
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# CSRF-exempt audit

The TlamatiniVsOpenClaw report counted 60+ `@csrf_exempt` decorators in
`Tlamatini/agent/views.py`. Most are necessary for WebSocket-adjacent
JSON endpoints, but the wholesale exemption is a security smell.

## Procedure

1. Grep `Tlamatini/agent/views.py` for `@csrf_exempt`.
2. For each match, inspect the view above it and classify:
   - `unsafe-without-csrf`: state-changing POST that should NOT be exempt.
   - `safe-because-websocket`: feeds a WebSocket session-restore path.
   - `safe-because-internal-tool`: only callable by Tlamatini's own JS;
     a CSRF token would be appropriate.
   - `unknown`: needs human review.
3. For each non-`safe-because-websocket` row, propose the smallest fix
   (token tag, middleware exception, view rewrite).

Return `{ total, classifications: [{view_name, kind}], recommendations: [...] }`.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [XAIHT](https://github.com/XAIHT)
- **Source:** [XAIHT/Tlamatini](https://github.com/XAIHT/Tlamatini)
- **License:** MIT
- **Homepage:** https://xaiht.org

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** yes
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-xaiht-tlamatini-tlamatini-csrf-exempt-audit
- Seller: https://agentstack.voostack.com/s/xaiht
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.