القائمة
Audit & fix RBAC and audit log compliance in API endpoints and frontend components
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/trycompai/comp --skill audit-rbacيبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
Run all audit checks (RBAC, hooks, design system, tests) and verify build
Check code for the most common, high-risk security vulnerabilities (broken access control, tenant isolation, injection, secrets, SSRF, auth/session, unsafe file handling, mass assignment) before it ships. Use after editing any API controller, guard, or auth code (apps/api/src/auth/**), a Prisma schema/query, a file-upload/webhook handler, or before committing/pushing security-sensitive changes.
How to reuse ANY integration check's results in a feature via the universal CheckResultsService (apps/api integration-platform). Use whenever a feature needs data produced by an integration check — "show 2FA status on People", "surface AWS S3 findings in X", "reuse a check's results", "per-user/per-resource results from a connected integration", "which integrations feed task T". Read this BEFORE writing your own IntegrationCheckResult / CheckRunRepository query — don't hand-roll it.
استنادا إلى تصنيف SOC المهني
عرض SKILL.md
| name | audit-rbac |
| description | Audit & fix RBAC and audit log compliance in API endpoints and frontend components |
Audit the specified files or directories for RBAC and audit log compliance. Fix every issue found immediately.
apps/api/src/)@RequirePermission('resource', 'action'). If missing, add it.@RequirePermission('resource', 'read'). If missing, add it./me/preferences) may skip @RequirePermission — authentication via HybridAuthGuard is sufficient.@Controller({ path: 'name', version: '1' }), NOT @Controller('v1/name'). If wrong, fix it.@UseGuards(HybridAuthGuard, PermissionGuard) at controller or endpoint level. Never skip PermissionGuard.@Public() — no auth required.apps/app/src/)usePermissions from @/hooks/use-permissions. If not:
{hasPermission('resource', 'create') && <Button>...disabled={!canUpdate}disabled={!canUpdate}role.includes('admin')) — use hasPermission().canAccessRoute(permissions, 'routeSegment').requireRoutePermission('segment', orgId) server-side.organization, member, control, evidence, policy, risk, vendor, task, framework, audit, finding, questionnaire, integration, apiKey, trust, pentest, app, compliance
app:read gates compliance dashboard; pentest:read gates security productpolicy, compliance) do NOT grant app access$ARGUMENTS (or scan the directory)bunx turbo run typecheck --filter=@trycompai/api --filter=@trycompai/app