菜单
Verify every SQLAlchemy model change ships with a matching Alembic migration in the same commit. Use when the user says "run /migration-lint", is about to push a change to backend/app/db/models.py or platform_models.py, or asks why CI is complaining about model drift.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Scan route handlers for PHI-touching routes that don't inject or call AuditService. Use when the user asks to audit the HIPAA audit-logging guardrail, says "run /audit-coverage-check", or adds new routes under /patients, /sessions, /appointments, /notes, /transcript, /audio, /soap, /resolve-client, /import-clients.
Weekly human-in-the-loop review of the latest automated pentest report. Pulls the newest report from pablohealth-oss GCS, summarizes findings, offers to open it, then publishes to docs/pentest/ and pablo-marketing/public/security.html via PR. Use when the user says "run /review-pentest", asks to review this week's pentest, or wants to publish the latest pentest report.
Run the owner-authorized weekly pentest on the deployed Pablo app (Cloud Run + Firebase + Cloud SQL). Use when the user asks for a pentest, security test, HIPAA review of the live deployment, or says "run /pentest".
Verify that every RLS-forced tenant table (any table with user_id, patient_id, or id column that is not in not_row_scoped) is covered by the RLS invariant suite and that no tenant table would be left unclassified (deny-all) by enable_rls_on_schema. Use when the user says "rls coverage", adds or alters a table in backend/app/db/models.py, asks about "has_patient_access" enforcement or the "fail-closed registry", or wants to check "new tenant table" safety before pushing.
Run the owner-authorized weekly pentest on the deployed Pablo app (Cloud Run + Firebase + Cloud SQL). Use when the user asks for a pentest, security test, HIPAA review of the live deployment, or says "run /pentest".
Find logger / print / structlog calls in backend/app/ that reference PHI field names. Use when the user says "run /phi-log-scan", worries a new log line might leak PHI, or is reviewing a CI failure about PHI in stdout. Intentional AuditService calls are excluded.
| name | migration-lint |
| description | Verify every SQLAlchemy model change ships with a matching Alembic migration in the same commit. Use when the user says "run /migration-lint", is about to push a change to backend/app/db/models.py or platform_models.py, or asks why CI is complaining about model drift. |
| tools | ["Read","Bash","Glob"] |
Enforces CLAUDE.md guardrail #4: "Models and migrations ship together."
Any change to backend/app/db/models.py or
backend/app/db/platform_models.py in the diff must be accompanied by
at least one new file under backend/alembic/versions/ in the same
diff.
# Default: compare HEAD to origin/main (PR-style check)
python .claude/skills/migration-lint/check.py
# Compare against a specific ref
python .claude/skills/migration-lint/check.py --base main
python .claude/skills/migration-lint/check.py --base HEAD~1
# Check the staged index only (pre-commit use)
python .claude/skills/migration-lint/check.py --staged
The script shells out to git diff --name-status <base>...HEAD (or
--cached for --staged) to get a reliable list of changed files.
| Condition | Result |
|---|---|
| Model file changed (Modified / Added), at least one new migration file added | PASS |
| Model file changed, no new migration file in diff | FAIL (exit 1) |
| Only migration files changed (e.g. a data fix) | PASS |
| No model files changed | PASS (no-op) |
One of:
migration-lint: no model changes - nothing to checkmigration-lint: OK - <N> model file(s) changed, <M> new migration(s) addedmigration-lint: FAIL - model files changed without a new migration: plus
the list of offending paths and a pointer to
alembic revision --autogenerate -m "<message>".