Menu
Audit that docs/rbac-permission-matrix.md matches the RBAC catalog in code (roles, permissions, and grants in rbac.constants.ts and api-contracts permissions.ts). Reports every mismatch.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Generate CRUD boilerplate (backend NestJS controller/service/module/guard/policy/factory/routes/e2e + frontend Redux slice/thunks/selectors/middleware/spi/api) from a given entity file and a list of methods.
Run the last steps before ending a feature. Shows a form where you can check/uncheck which final steps to run — update changelog, create a branch, run tests-parallel, create a PR — then executes the selected steps in that order.
Create a GitHub issue on bayesimpact/bayes-platform from a free-text description. Drafts a clear title and structured body, picks appropriate labels, and posts it via the gh CLI, returning the issue URL. Optionally enriches the issue with context from the current codebase.
Suggest a Conventional Commits message for the last changes without committing. Analyzes the current diff and returns a ready-to-use commit name.
Run Trivy vulnerability scan on Docker images (API, CPU workers, GPU workers). Builds images, scans for CRITICAL/HIGH CVEs, and reports findings.
Audit apps/web for the two paired rules from ADR 0010 — every `*.models.ts` has a sibling `*.factory.ts`, and every route registered in `{Scope}Routes.tsx` has a matching `stories/routes/{scope}/{Route}.stories.tsx`. Reports missing factories and missing route stories.
| name | check-permission-matrix |
| description | Audit that docs/rbac-permission-matrix.md matches the RBAC catalog in code (roles, permissions, and grants in rbac.constants.ts and api-contracts permissions.ts). Reports every mismatch. |
Verify that docs/rbac-permission-matrix.md is an exact mirror of the RBAC catalog in code.
Read the two code sources of truth:
apps/api/src/domains/rbac/rbac.constants.ts — extract every role key and its granted permissions from ORGANIZATION_ROLE_PERMISSIONS, PROJECT_ROLE_PERMISSIONS, and AGENT_ROLE_PERMISSIONS (resolve permission constants such as TRACE_READ_PERMISSION to their string values).packages/api-contracts/src/rbac/permissions.ts — extract every member of the GlobalPermission union.Read docs/rbac-permission-matrix.md and parse each table into (permission, role) → granted/not-granted pairs.
Compare both directions and collect mismatches:
GlobalPermission union member absent from the "Global roles" tableReport the results:
For each mismatch show the role, the permission, what the code says, and what the doc says.
"N roles and M grants checked, X mismatches found." If everything matches, say the matrix is up to date. If there are mismatches, propose the exact doc edits to fix them.