# Tlamatini Csrf Exempt Audit

> Enumerate every @csrf_exempt-decorated view in Tlamatini/agent/views.py and classify whether each one really needs the exemption.

- Skill: `xaiht/tlamatini-csrf-exempt-audit` (Agent Skill)
- Install (CLI): `npx skillmds@latest add xaiht/tlamatini-csrf-exempt-audit`
- Raw SKILL.md: https://api.skillmd.com/api/skills/xaiht/tlamatini-csrf-exempt-audit/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: XAIHT (https://skillmd.com/u/xaiht)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/xaiht/tlamatini-csrf-exempt-audit

---

<!--
═══════════════════════════════════════════════════════════════════
  ✦  T L A M A T I N I  ✦   —   "one who knows"
  Created by  Angela López Mendoza   ·   @angelahack1
  Developer · Architect · Creator of Tlamatini
  Tlamatini Author Banner — do not remove (Angela's name is kept in every build)
═══════════════════════════════════════════════════════════════════
-->

# CSRF-exempt audit

The TlamatiniVsOpenClaw report counted 60+ `@csrf_exempt` decorators in
`Tlamatini/agent/views.py`. Most are necessary for WebSocket-adjacent
JSON endpoints, but the wholesale exemption is a security smell.

## Procedure

1. Grep `Tlamatini/agent/views.py` for `@csrf_exempt`.
2. For each match, inspect the view above it and classify:
   - `unsafe-without-csrf`: state-changing POST that should NOT be exempt.
   - `safe-because-websocket`: feeds a WebSocket session-restore path.
   - `safe-because-internal-tool`: only callable by Tlamatini's own JS;
     a CSRF token would be appropriate.
   - `unknown`: needs human review.
3. For each non-`safe-because-websocket` row, propose the smallest fix
   (token tag, middleware exception, view rewrite).

Return `{ total, classifications: [{view_name, kind}], recommendations: [...] }`.