Audit Pra-Launch: SKILL.md & Kualitas

Audit Pra-Launch: SKILL.md & Kualitas | Launch dan Workflow Pribadi | Mahir.dev | Mahir.dev Academy

platform-donasi-rules/
└── SKILL.md

---
name: platform-donasi-rules
description: "Use when changing or reviewing Platform Donasi Amanah features. Enforce donation status, privacy, verification, and launch rules."
---
 
# Platform Donasi Rules
 
Use this skill when the task touches campaign, donation, verification, transparency, privacy, or deployment.
 
## Rules
 
1. Donation status starts as pending.
2. Upload proof never changes status to verified.
3. Approve may change pending to verified only when proof exists.
4. Public transparency uses aggregate verified donations only.
5. Public routes must not expose donor email, phone, token hash, idempotency key, or private proof path.
6. Service role key is server-only and never uses NEXT_PUBLIC_ prefix.
7. Final response must include changed files and verification evidence.

Kebutuhan	Lensa skill/checklist
Copy terdengar AI/generik	antislop / no-ai-slop
Landing dan CTA kurang jelas	copywriting / marketing-council
UI sulit dipakai	UX review / accessibility review
Risiko auth, RLS, secret, upload	appsec-code-review / security checklist
Aturan domain Platform Donasi	skill buatan sendiri

---
name: platform-donasi-rules
description: "Use when changing or reviewing Platform Donasi Amanah. Enforce donation status, RLS/privacy, proof upload, verification, transparency, and launch gates."
---
 
# Platform Donasi Rules
 
## Status and payment
 
- New donations start as `pending`.
- Proof upload only stores proof metadata; it must not mark a donation as `verified`.
- Manual approve can change `pending` to `verified` only when proof exists.
- Manual reject can change `pending` to `rejected`.
- Illegal status transitions must remain blocked by database trigger.
 
## Privacy
 
- Public pages must not expose donor email, phone, token hash, idempotency key, or private proof path.
- Guest confirmation must use donation number + token lookup, not public SELECT on donations.
- Transparency pages must use aggregate verified totals, not raw donation rows.
 
## Verification
 
Before calling a task done, run or document:
- `npm run lint`
- `npm run build`
- route/browser check for the changed flow
- SQL/storage checks when database or proof upload changes

text

Muat lensa antislop/no-ai-slop dan UX review.
 
Audit halaman:
- homepage campaign list
- halaman detail/donasi campaign
- halaman confirmation
 
Fokus:
1. Copy yang generik, terlalu AI, terlalu hiperbolik, atau kurang jelas.
2. CTA yang tidak menjelaskan aksi.
3. Error/success message yang membingungkan.
4. Mobile readability.
5. Dark pattern atau tekanan emosional yang tidak pantas.
6. Kepatuhan syar'i: tidak memakai aurat, musik, simbol agama lain, atau ajakan manipulatif.
 
Output hanya audit, jangan edit file.
Format:
- Lokasi
- Temuan
- Risiko
- Perbaikan spesifik
- Severity: P0/P1/P2

text

Muat lensa marketing-council/copywriting.
 
Audit pesan campaign "Paket Pangan untuk Keluarga".
 
Nilai:
1. Apakah masalahnya jelas tanpa eksploitasi kesedihan?
2. Apakah nominal donasi terhubung ke dampak konkret?
3. Apakah CTA menjelaskan aksi berikutnya?
4. Apakah laporan/transparansi cukup dipercaya?
5. Apakah ada klaim yang butuh bukti tambahan?
 
Jangan edit file. Beri rekomendasi copy yang lebih jelas, tenang, dan amanah.

text

Muat lensa appsec-code-review atau gunakan checklist security manual.
 
Audit Platform Donasi Amanah sebelum GO.
 
Scope:
- auth/admin guard
- RLS donors/donations/payments
- guest confirmation token
- proof upload storage
- public transparency function
- env/secret leakage
- dependency dan build output
 
Cek minimal:
1. Tidak ada service role key di client bundle atau kode client.
2. Halaman confirmation tanpa token/salah token tidak membuka data.
3. Public aggregate function tidak mengembalikan PII.
4. Bucket transfer proof private.
5. Admin approve/reject tidak bisa dipanggil non-admin.
6. Upload proof menolak file type/size yang salah.
7. `npm audit` atau audit dependency dicatat, minimal untuk temuan high/critical.
 
Output hanya audit, jangan edit file.
Format: Temuan → Risiko → Bukti → Rekomendasi → Severity.

# Audit Pra-Launch
 
## P0 — wajib sebelum GO
- [ ] [Security] Service role key ditemukan di client bundle.
  - Bukti: ...
  - Perbaikan: pindahkan ke server-only env dan ulang build.
 
## P1 — minggu pertama
- [ ] [UX] Error nominal terlalu teknis.
  - Bukti: ...
  - Perbaikan: ubah copy error agar bisa dipahami donatur.
 
## P2 — nanti
- [ ] [Copy] Headline bisa dibuat lebih spesifik.

Audit Pra-Launch: SKILL.md & Kualitas

SKILL.md itu apa?

Skill siap pakai vs skill buatan sendiri

Buat skill domain Platform Donasi

Audit copy, marketing, dan UI

Audit marketing dengan batas yang sehat

Audit keamanan sebelum GO

Prioritaskan temuan

Checkpoint

Kuis 06.2 — Audit Pra-Launch: SKILL.md & Kualitas

Diskusi Pelajaran