SOC 직업 분류 기준
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
직접 명령은 검토 Prompt를 거치지 않습니다. 실행하기 전에 소스를 확인하세요.
npx skills add https://github.com/trycompai/comp --skill essentials명령은 한 줄로 유지됩니다. 복사하기 전에 가로로 스크롤해 전체 내용을 확인하세요.
로컬 사본을 원하시나요? SkillsMP에서 현재 제공할 수 있는 파일을 다운로드하세요.
SKILL.md 표시 중
Run all audit checks (RBAC, hooks, design system, tests) and verify build
Check code for the most common, high-risk security vulnerabilities (broken access control, tenant isolation, injection, secrets, SSRF, auth/session, unsafe file handling, mass assignment) before it ships. Use after editing any API controller, guard, or auth code (apps/api/src/auth/**), a Prisma schema/query, a file-upload/webhook handler, or before committing/pushing security-sensitive changes.
How to reuse ANY integration check's results in a feature via the universal CheckResultsService (apps/api integration-platform). Use whenever a feature needs data produced by an integration check — "show 2FA status on People", "surface AWS S3 findings in X", "reuse a check's results", "per-user/per-resource results from a connected integration", "which integrations feed task T". Read this BEFORE writing your own IntegrationCheckResult / CheckRunRepository query — don't hand-roll it.
| name | essentials |
| description | Critical rules that must always be followed |
Source Cursor rule: .cursor/rules/essentials.mdc.
Original file scope: **/*.{ts,tsx}.
Original Cursor alwaysApply: true.
Use bun, never npm/yarn/pnpm.
bun install # Install deps
bun add <pkg> # Add package
bun run <script> # Run script
bunx <cmd> # Execute binary
Use @trycompai/design-system first, @trycompai/ui only as fallback.
// ✅ Design system
import { Button, Card, Input, Select } from '@trycompai/design-system';
import { Add, Close } from '@trycompai/design-system/icons';
// ❌ Don't use when DS has the component
import { Button } from '@trycompai/ui/button';
import { Plus } from 'lucide-react';
No className on DS components - use variants and props only.
// ✅ Use variants
<Button variant="destructive" size="sm">Delete</Button>
// ❌ No className overrides
<Button className="bg-red-500">Delete</Button>
No any. No unsafe type assertions.
// ✅ Validate external data with zod
const TaskSchema = z.object({ id: z.string(), title: z.string() });
const task = TaskSchema.parse(response.data);
// ❌ Never
const data: any = fetchData();
const task = response as Task;
Get organizationId from URL params, not session.
// ✅ From params
export default async function Page({ params }: { params: Promise<{ orgId: string }> }) {
const { orgId } = await params;
}
// ❌ Not from session
const session = await auth.api.getSession();
const orgId = session?.session?.activeOrganizationId;
Server components fetch, pass to client with SWR fallbackData.
// Server page
const data = await fetchData(orgId);
return <ClientComponent initialData={data} />;
// Client component
const { data } = useSWR(key, fetcher, { fallbackData: initialData });
No nuqs - use React useState for UI state, Next.js for URL state.
// ✅ React state for UI
const [isOpen, setIsOpen] = useState(false);
// ❌ No nuqs
import { useQueryState } from 'nuqs';
Always run checks after code changes:
bun run typecheck
bun run lint
Fix all errors before committing.