Phoenix API Generator
ReviewAudited by ClawScan on May 10, 2026.
Overview
This instruction-only Phoenix API generator is not malicious, but its tenant/auth templates could generate APIs that trust a user-supplied tenant header and fail to scope some record actions by tenant.
Install or use this only if you will carefully review the generated code. Pay particular attention to tenant and authorization logic: do not trust x-tenant-id directly, scope every read/update/delete query by tenant, add cross-tenant denial tests, and review all migrations and router changes before merging.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Using the skill can change application code, routes, tests, and database migrations.
The skill is intended to create or modify many project files. This is disclosed and purpose-aligned, but it is still a meaningful local project mutation.
Generate schemas, migrations, controllers, views, router, and tests. Ask the user to confirm before writing files.
Use version control, review the generated diff, and require explicit approval before applying generated files.
If generated as-is, API clients may be able to choose or spoof a tenant ID and access another tenant's data.
The tenant selection pattern assigns tenant identity directly from a client-controlled header, with no shown validation against the authenticated account or token claims.
tenant_id = get_req_header(conn, "x-tenant-id") |> List.first() assign(conn, :tenant_id, tenant_id)
Derive tenant identity from authenticated claims or verify the header against the authenticated user's memberships before assigning it.
Generated APIs could allow cross-tenant reads, updates, or deletes if record IDs are guessed or exposed.
The controller pattern scopes the index action by tenant, but show/update/delete retrieve records only by ID. That contradicts the stated tenant-scoped API goal and can propagate into generated production code.
def show(conn, %{"id" => id}) do
user = Accounts.get_user!(id)
...
def update(conn, %{"id" => id, "user" => params}) do
user = Accounts.get_user!(id)
...
def delete(conn, %{"id" => id}) do
user = Accounts.get_user!(id)Generate tenant-scoped get/update/delete functions, pass tenant_id into every resource lookup, and add tests that deny cross-tenant access.