菜单
Analyzes authentication flows, authorization rules, middleware logic, and side-effects. Use when extracting business rules, Passport configurations, or mailer logic from an Express application.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Enforces data governance by verifying Knowledge Catalog Aspects before recommending BigQuery tables.
Ensures the game has a fun easter egg that turns the screen black and white, sepia or gameboy monotone colours. Use when creating or modifying a game.
Ensures platformer games have polished movement, responsive controls, and balanced jump mechanics. Use ONLY when the game type is "platformer".
Guides the creation of a new game and is the high-level orchestrator skill that MUST be invoked first. Use when tasked with creating a new game.
Arcade game must have a retro asthetic. Use when creating or modifying a game to ensure that the game looks retro and maintains a consistent look and feel with all games.
Game will always use the same control scheme/buttons and mapping of the gamepad and keyboard. Use when creating or modifying a game.
| name | auditing-business-logic |
| description | Analyzes authentication flows, authorization rules, middleware logic, and side-effects. Use when extracting business rules, Passport configurations, or mailer logic from an Express application. |
Analyze the implicit "rules" and external behaviors of a legacy application to ensure they are accurately replicated in the modern architecture.
Reverse-engineer the application's authentication flows, authorization logic (RBAC/ABAC), and any asynchronous side-effects (Mailers, External APIs, File Storage).
Copy this checklist and track your progress:
Task Progress:
- [ ] Step 1: Analyze AuthN & AuthZ Flows
- [ ] Step 2: Map Side-Effects (External APIs, Mailers)
- [ ] Step 3: Analyze Global Middleware
- [ ] Step 4: Draft Modernization Advisory
- [ ] Step 5: Generate Business_Logic_Rules.md
config/passport.js). Document the login strategies (Local, OAuth, etc.) and required fields.requiresRole('admin') or isOwner(resource_id)).Identify actions that occur outside of the primary request/response cycle:
package.json and controllers for Stripe (Payments), Twilio (SMS), SendGrid (Email), etc.mailer/ or services/email/ directory. Does creating a resource trigger an automated notification?Examine app.js or config/express.js. Document global middlewares such as helmet, cors, custom loggers, or csurf. Determine which remain relevant for a modern Next.js API.
Flag potential pitfalls for the modern stack (e.g., Next-Auth vs Passport). Recommend modern equivalents for legacy side-effects (e.g., moving from local file storage to S3/Uploadthing).
Compile findings into docs/legacy-audit/Business_Logic_Rules.md. Additionally, identify specific logic-parity probes (e.g., "Attempt to submit a form without the required OAuth session to verify the redirect loop matches legacy"). Append these logic-specific test cases to docs/verification/Verification_Plan.md.