nocobase-acl-manage

Task-driven ACL governance through nb CLI for role lifecycle, global role mode, permission policy, user-role membership, and risk assessment. Use when users describe business permission outcomes instead of raw command arguments.

Ir a la instalación

Repositorio: Agents-Store/claude-plugins
Última actividad en el origen: 11 de mayo de 2026 a las 16:59
Idioma detectado de SKILL.md: inglés
Estrellas: 0
Forks: 0

Opciones de instalación

De forma predeterminada está seleccionado el prompt que primero revisa el origen. Puedes cambiar a un comando directo o descargar una copia local.

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.

npx skills add https://github.com/Agents-Store/claude-plugins --skill nocobase-acl-manage

El comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.

¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.

Revisa los archivos de origen

Lee SKILL.md y los archivos complementarios que muestra SkillsMP antes de decidir si quieres instalarlo.

Explorador de archivos

17 archivos

SKILL.md

Instrucciones de origen · Vista previa de solo lectura

Volver a la búsqueda Volver a la instalación

feedback

This skill should be used when the user reports a problem with macstack-dev or the MACSTACK standard — "this skill did the wrong thing", "the schema is missing a field", "the passport for X is wrong", "send macstack feedback", "improve the schema based on my edit", "fix the macstack plugin" — and the fix must land in the right source (plugin, schema repo, or registry repo).

2026-08-09

infisical-env

This skill should be used when the user asks to "set up Infisical for this project", "create .infisical.json", "pull the env keys", "wire the env", "sync secrets", or scaffold-project reaches the env step. Creates .infisical.json, pulls .env.prod/.env.dev, ensures every key from macstack.json resources.accesses exists, and installs the mandatory secrets scripts and commands.

2026-08-09

scaffold-project

This skill should be used when the user asks to "scaffold the project from macstack.json", "create the project working files", "generate project files from the spec", "build the project from macstack.json", or after a macstack.json is validated and the working tree must be built. Creates project files strictly in the prototype → stack plugins → dev plugins order.

2026-08-09

Ver todos los de este repositorio

Non-Goals

Do not bypass CLI by calling direct REST endpoints.

Do not mutate ACL through ad-hoc database operations.

Do not create temporary script files to execute ACL writes.

Do not invoke other skills for env/plugin bootstrap; use direct nb commands in this skill.

Do not hide high-impact blast radius (global mode, broad snippets, broad strategy actions).

Do not claim one-click coverage for workflows that require governance review.

Canonical Task Model

A) Role Domain

Task

User Outcome

Required Inputs

Optional Inputs

role.audit-all

list all roles with comparable policy summary

none

data_source_key, output

role.create-blank

create a role with default read-only baseline (single creation mode)

role_name

role_title, description, hidden, allow_configure, allow_new_menu

role.compare

explain differences between roles

role_names[]

data_source_key, output

B) Global Role-Mode Domain

Task

Non-Goals

Do not bypass CLI by calling direct REST endpoints.

Do not mutate ACL through ad-hoc database operations.

Do not create temporary script files to execute ACL writes.

Do not invoke other skills for env/plugin bootstrap; use direct nb commands in this skill.

Do not hide high-impact blast radius (global mode, broad snippets, broad strategy actions).

Do not claim one-click coverage for workflows that require governance review.

Canonical Task Model

A) Role Domain

Task

User Outcome

Required Inputs

Optional Inputs

role.audit-all

list all roles with comparable policy summary

none

data_source_key, output

role.create-blank

create a role with default read-only baseline (single creation mode)

role_name

role_title, description, hidden, allow_configure, allow_new_menu

role.compare

explain differences between roles

role_names[]

data_source_key, output

B) Global Role-Mode Domain

Task

name	nocobase-acl-manage
description	Task-driven ACL governance through nb CLI for role lifecycle, global role mode, permission policy, user-role membership, and risk assessment. Use when users describe business permission outcomes instead of raw command arguments.
argument-hint	[task: role.\|global.role-mode.\|permission.\|user.\|risk.*] [target?] [data_source_key?] [strict_mode?]
allowed-tools	shell, local file reads
owner	platform-tools
version	2.5.3
last-reviewed	"2026-04-23T00:00:00.000Z"
risk-level	high

name	nocobase-acl-manage
description	Task-driven ACL governance through nb CLI for role lifecycle, global role mode, permission policy, user-role membership, and risk assessment. Use when users describe business permission outcomes instead of raw command arguments.
argument-hint	[task: role.\|global.role-mode.\|permission.\|user.\|risk.*] [target?] [data_source_key?] [strict_mode?]
allowed-tools	shell, local file reads
owner	platform-tools
version	2.5.3
last-reviewed	"2026-04-23T00:00:00.000Z"
risk-level	high

`global.role-mode.get`	read current global role mode	none	`output`
`global.role-mode.set`	switch global role mode	`role_mode`	`strict_mode`

Task	User Outcome	Required Inputs	Optional Inputs
`permission.system-snippets.set`	set role-level system snippets	`role_name`, (`snippet_preset` or `snippets`)	none
`permission.route.desktop.set`	set desktop route permissions for a role	`role_name`, `route_ids[]`	`set_mode` (`set` or `add` or `remove`)
`permission.data-source.global.set`	set global strategy actions for all tables in one data source	`role_name`, `global_actions[]`	`data_source_key`
`permission.data-source.resource.set`	set independent actions for one or more collections	`role_name`, (`collection_hint` or `collection_hints[]`), `actions[]`	`data_source_key`, `fields_map`, `scope_map`, `resource_scope` (`all` by default)
`permission.scope.manage`	create/update/list reusable scopes	`scope_task`	`data_source_key`, `scope_id`, `scope_payload`

Task	User Outcome	Required Inputs	Optional Inputs
`user.assign-role`	assign one role to one or many users	`role_name`, (`user_ids[]` or `user_filter`)	`allow_generic_association_write`
`user.unassign-role`	remove one role from one or many users	`role_name`, (`user_ids[]` or `user_filter`)	`allow_generic_association_write`
`user.audit-role-membership`	inspect users bound to roles	(`role_name` or `user_id`)	`output`

nocobase-acl-manage

Opciones de instalación

Revisa los archivos de origen

Goal

Scope

Non-Goals

Canonical Task Model

A) Role Domain

B) Global Role-Mode Domain

Goal

Scope

Non-Goals

Canonical Task Model

A) Role Domain

B) Global Role-Mode Domain

C) Permission Domain

D) User Domain

E) Risk Domain

Input Contract

Mandatory Clarification Gate

Workflow

Tooling Policy

Safety Gate

Capability Boundary Messaging

Verification Checklist

Minimal Test Scenarios

Reference Loading Map

References

Task	User Outcome	Required Inputs	Optional Inputs
`risk.assess-role`	risk score and rationale for one role	`role_name`	`data_source_key`, `output`
`risk.assess-user`	risk score based on user-role-permission relationship	`user_id`	`data_source_key`, `output`
`risk.assess-system`	system-level ACL governance risk summary	none	`data_source_key`, `output`

Input	Required	Default	Validation	Clarification Question
`task`	yes	none	one of canonical tasks or alias	"Which ACL governance task should run?"
`role_name`	conditional	none	role exists for update/audit tasks; write tasks normalize to `r_*` uid	"Which role should be targeted?"
`role_mode`	conditional	none	one of `default/allow-use-union/only-use-union`	"Which global role mode should be set?"
`collection_hint` / `collection_hints[]`	conditional	none	required for `permission.data-source.resource.set`; business name/keyword input is allowed	"Which business table(s) should be configured?"
`resolved_collection_names[]`	conditional	runtime resolved	required before write for `permission.data-source.resource.set`; each collection must exist in selected data source	"I found these matching collections. Which should be used?"
`actions[]`	conditional	none	required for `permission.data-source.resource.set`	"Which actions should be granted on these collections?"
`resource_scope`	no	`all`	one of `all` / `own` / `custom(scope_id or scope_filter)`	"Which data scope should be used? Default is all; choose own/custom only when needed."
`data_source_key`	no	`main`	must exist at runtime	"Which data source key should be used? (default: main)"
`strict_mode`	no	`safe`	`safe` or `fast`	"Use safe mode with full readback?"
`allow_generic_association_write`	no	`false`	boolean	"Allow guarded generic association writes for user-role assignment?"
`output`	no	`text+matrix`	`text`, `text+matrix`, `text+evidence`	"How detailed should the result be?"

Reference	Use When	Notes
references/intent-presets-v1.md	intent normalization and defaults	includes global role-mode wording
references/intent-to-tool-map-v1.md	runtime command resolution	maps logical tasks to CLI command patterns
references/execution-guard-template.md	every ACL write task	fixed preflight command template for base-dir lock and fail-closed checks
references/result-format-v1.md	output rendering	includes risk cards and capability path
references/configuration.md	ACL policy details	detailed data-source and scope guidance
references/independent-permissions.md	resource-level permission writes	`usingActionsConfig + actions + fields + scope` complete-write policy
tests/capability-test-plan.md	capability matrix	aligned with v2 domains
tests/test-playbook.md	acceptance regression	prompt-first TC01, TC02, TC04-TC20 with runtime evidence commands
references/refactor-plan-v2.md	capability gaps and rollout plan	includes CLI migration notes
tests/README.md	runtime verification	playbook execution flow and reporting notes

nocobase-acl-manage

Datos de origen

Opciones de instalación

Revisa los archivos de origen

Más de este repositorio

Goal

Scope

Non-Goals

Canonical Task Model

A) Role Domain

B) Global Role-Mode Domain

Más de este repositorio

Goal

Scope

Non-Goals

Canonical Task Model

A) Role Domain

B) Global Role-Mode Domain

C) Permission Domain

D) User Domain

E) Risk Domain

Input Contract

Mandatory Clarification Gate

Workflow

Tooling Policy

Safety Gate

Capability Boundary Messaging

Verification Checklist

Minimal Test Scenarios

Reference Loading Map

References