Menu
Audit & fix RBAC and audit log compliance in API endpoints and frontend components
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/trycompai/comp --skill audit-rbacThe command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Run all audit checks (RBAC, hooks, design system, tests) and verify build
Check code for the most common, high-risk security vulnerabilities (broken access control, tenant isolation, injection, secrets, SSRF, auth/session, unsafe file handling, mass assignment) before it ships. Use after editing any API controller, guard, or auth code (apps/api/src/auth/**), a Prisma schema/query, a file-upload/webhook handler, or before committing/pushing security-sensitive changes.
How to reuse ANY integration check's results in a feature via the universal CheckResultsService (apps/api integration-platform). Use whenever a feature needs data produced by an integration check — "show 2FA status on People", "surface AWS S3 findings in X", "reuse a check's results", "per-user/per-resource results from a connected integration", "which integrations feed task T". Read this BEFORE writing your own IntegrationCheckResult / CheckRunRepository query — don't hand-roll it.
Based on SOC occupation classification
Showing SKILL.md
| name | audit-rbac |
| description | Audit & fix RBAC and audit log compliance in API endpoints and frontend components |
Audit the specified files or directories for RBAC and audit log compliance. Fix every issue found immediately.
apps/api/src/)@RequirePermission('resource', 'action'). If missing, add it.@RequirePermission('resource', 'read'). If missing, add it./me/preferences) may skip @RequirePermission — authentication via HybridAuthGuard is sufficient.@Controller({ path: 'name', version: '1' }), NOT @Controller('v1/name'). If wrong, fix it.@UseGuards(HybridAuthGuard, PermissionGuard) at controller or endpoint level. Never skip PermissionGuard.@Public() — no auth required.apps/app/src/)usePermissions from @/hooks/use-permissions. If not:
{hasPermission('resource', 'create') && <Button>...disabled={!canUpdate}disabled={!canUpdate}role.includes('admin')) — use hasPermission().canAccessRoute(permissions, 'routeSegment').requireRoutePermission('segment', orgId) server-side.organization, member, control, evidence, policy, risk, vendor, task, framework, audit, finding, questionnaire, integration, apiKey, trust, pentest, app, compliance
app:read gates compliance dashboard; pentest:read gates security productpolicy, compliance) do NOT grant app access$ARGUMENTS (or scan the directory)bunx turbo run typecheck --filter=@trycompai/api --filter=@trycompai/app