Works with the AI Agents you already use
Claude Code
Cursor
Codex CLI
DeepSeek
Muse+22 moreClaude CodeCursorCodex CLIDeepSeekMuse
Dots
Manus
Grok
Grok Bot+18 agentsRepair Signed URL Canonicalization
Repair signed URL verification failures and bypasses caused by inconsistent path, query, percent-encoding, Unicode, host, port, method, duplicate-parameter, or proxy normalization.
$1
Repair Signed URL Canonicalization
Example session with this skill installed
Our Go download signer signs URL.EscapedPath and ordered query pairs, but verification rebuilds the URL from router params and url.Values, which decodes the path and sorts duplicate keys. Repair with golden vectors and local requests. Preserve HMAC, key IDs, expiry, nonce policy, proxy trust, and errors.
- Read your context and instructions
- Compiled the repair signed url
Canonical-input defect found. Verification reconstructs a semantic URL rather than authenticating the same byte-level request target used by the signer, collapsing duplicate query pairs and changing escaped path bytes. The repair defines one versioned canonical byte format shared by signer/verifier, gates proxy-derived authority through existing trust policy, preserves HMAC/key/expiry/nonce/error behavior, and validates adversarial encodings with golden vectors.
Connects securely to your tools. The creator never sees your data.
About this skill
The problem
Signed URL verification often fails because signers and verifiers canonicalize request targets differently. Discrepancies in path encoding, query key ordering, or proxy headers lead to intermittent 403 errors or security bypasses.
What it does
- Identifies mismatches between signer and verifier canonicalization logic across the repository.
- Standardizes handling of percent-encoding, Unicode variants, and duplicate query keys.
- Hardens proxy trust gates by ensuring verification uses preserved request targets rather than reconstructed inputs.
- Generates byte-stable golden vectors and adversarial local fixtures for regression testing.
- Implements redacted observability to track verification failures without leaking sensitive tokens.
Frameworks & tools
Works with any web framework or proxy configuration including Nginx, AWS CloudFront, Express, Go, and Python. Uses Read, Edit, and Bash tools for repository-level repairs.
Why this beats prompting it yourself
General LLMs often suggest simple encoding fixes that break in production behind proxies. This skill enforces a strict resource register and canonical contract, ensuring that normalization logic is consistent across the entire request lifecycle.
Use cases
- Resolving 403 Forbidden errors caused by URL re-encoding in middleware.
- Securing webhook endpoints against host-header injection and request smuggling.
- Standardizing signature verification for APIs supporting complex query parameters.
- Debugging inconsistent verification between local development and staging environments.
Known limitations
Requires local repository access to signer and verifier source code. Cannot mutate live production infrastructure or rotate actual secrets.
Find more skills like this on the Claude Skills Marketplace, the Codex Skills Marketplace and the Gemini Skills Marketplace, or browse Claude Skills for APIs & Backend.
Cannot choose or change signature algorithm, key rotation, expiry, replay controls, authorization policy, proxy trust, and public errors; cannot verify production infrastructure or prove every runtime, proxy, network, or scheduler ordering.
How to use
- 1
Connect your agent to the Agensi MCP
Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup
- 2
Sign in to Agensi
Your agent shows a sign-in link. Sign in and click Allow.
- 3
Ask for what you need
Your agent loads this skill and uses it on your task. It always asks before buying a skill.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill goes through the trust checks below.
Security scanned
Checked by our 8-point scan before listing
Fresh listing
Recently published to Agensi
Money-back guarantee
Doesn't do what its page promises? You get your money back.
Trust & safety
Security scan
Security scan passed 2 months ago
Permissions
Run on a clean branch with repository files and disposable local fixtures. Review every patch and validation result before merge. Keep production services, real credentials, customer payloads, and deployment out of scope.