Why shouldn't I use the communityId from the request body?

Using the communityId from the request body is a security risk because an attacker can forge the ID to access data from other tenants. The skill enforces using the ID from a verified JWT token.

Does this skill apply to the Community collection itself?

No, the Community collection is the root tenant entity and does not contain a communityId field, so it is treated as an exception for administrative operations.

How does this skill affect database indexing?

It mandates that all compound indexes must have communityId as the first field, ensuring both query efficiency and logical isolation at the database level.

What is the primary goal of the Tenancy Enforcer skill?

The primary goal is to ensure that every database query in the Aegis platform includes a communityId filter, preventing users from accessing or modifying data belonging to other communities.

Aegis Multi-Tenancy Enforcer

Name: Aegis Multi-Tenancy Enforcer
Author: muhammadcaeed

bymuhammadcaeed

0•

Security & Testing

Enforces strict multi-tenant data isolation by ensuring communityId is applied to all MongoDB queries and service logic.

The Aegis Multi-Tenancy Enforcer is a specialized skill designed to maintain high security and logical data isolation within the Aegis community platform. It provides Claude with a rigorous framework for writing MongoDB queries, repository methods, and service layers that mandate the inclusion of a community identifier in every operation. By prioritizing communityId extraction from authenticated JWT tokens rather than potentially forged request bodies, it effectively prevents cross-community data leaks and ensures that all database indexes and aggregation pipelines are optimized for tenant-specific access.

Key Features

01Automated enforcement of communityId filters in all MongoDB CRUD operations

02Detailed verification checklists for aggregate pipelines and service layer logic

03Secure tenant identification via JWT context over request body parameters

04Standardized repository patterns for secure find, update, and delete methods

050 GitHub stars

06Mandatory tenant-first compound indexing guidelines for performance and isolation

Use Cases

01Implementing secure repository layers in NestJS or Node.js MongoDB applications

02Auditing existing backend logic for multi-tenancy compliance and security gaps

03Preventing unauthorized cross-tenant data access in multi-user community platforms

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add muhammadcaeed/aegis tenancy-enforcer.md

For use in Claude.ai and ChatGPT

Key Features

01Automated enforcement of communityId filters in all MongoDB CRUD operations

02Detailed verification checklists for aggregate pipelines and service layer logic

03Secure tenant identification via JWT context over request body parameters

04Standardized repository patterns for secure find, update, and delete methods

050 GitHub stars

06Mandatory tenant-first compound indexing guidelines for performance and isolation

Use Cases

01Implementing secure repository layers in NestJS or Node.js MongoDB applications

02Auditing existing backend logic for multi-tenancy compliance and security gaps

03Preventing unauthorized cross-tenant data access in multi-user community platforms