菜单
Audit that docs/rbac-permission-matrix.md matches the RBAC catalog in code (roles, permissions, and grants in rbac.constants.ts and api-contracts permissions.ts). Reports every mismatch.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Generate CRUD boilerplate (backend NestJS controller/service/module/guard/policy/factory/routes/e2e + frontend Redux slice/thunks/selectors/middleware/spi/api) from a given entity file and a list of methods.
Run the last steps before ending a feature. Shows a form where you can check/uncheck which final steps to run — update changelog, create a branch, run tests-parallel, create a PR — then executes the selected steps in that order.
Create a GitHub issue on bayesimpact/bayes-platform from a free-text description. Drafts a clear title and structured body, picks appropriate labels, and posts it via the gh CLI, returning the issue URL. Optionally enriches the issue with context from the current codebase.
Suggest a Conventional Commits message for the last changes without committing. Analyzes the current diff and returns a ready-to-use commit name.
Run Trivy vulnerability scan on Docker images (API, CPU workers, GPU workers). Builds images, scans for CRITICAL/HIGH CVEs, and reports findings.
Audit apps/web for the two paired rules from ADR 0010 — every `*.models.ts` has a sibling `*.factory.ts`, and every route registered in `{Scope}Routes.tsx` has a matching `stories/routes/{scope}/{Route}.stories.tsx`. Reports missing factories and missing route stories.
| name | check-permission-matrix |
| description | Audit that docs/rbac-permission-matrix.md matches the RBAC catalog in code (roles, permissions, and grants in rbac.constants.ts and api-contracts permissions.ts). Reports every mismatch. |
Verify that docs/rbac-permission-matrix.md is an exact mirror of the RBAC catalog in code.
Read the two code sources of truth:
apps/api/src/domains/rbac/rbac.constants.ts — extract every role key and its granted permissions from ORGANIZATION_ROLE_PERMISSIONS, PROJECT_ROLE_PERMISSIONS, and AGENT_ROLE_PERMISSIONS (resolve permission constants such as TRACE_READ_PERMISSION to their string values).packages/api-contracts/src/rbac/permissions.ts — extract every member of the GlobalPermission union.Read docs/rbac-permission-matrix.md and parse each table into (permission, role) → granted/not-granted pairs.
Compare both directions and collect mismatches:
GlobalPermission union member absent from the "Global roles" tableReport the results:
For each mismatch show the role, the permission, what the code says, and what the doc says.
"N roles and M grants checked, X mismatches found." If everything matches, say the matrix is up to date. If there are mismatches, propose the exact doc edits to fix them.