菜单
Use when routes or actions must be gated by user role: gate routes and actions behind roles so only authorised users can perform them.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Use when several pieces of work are genuinely independent and can run at once, to fan them out across parallel agents instead of doing them in sequence. Cuts wall-clock time and keeps each strand in its own clean context.
Use when a written plan exists and you are about to build it in the current session, to work it task by task with a checkpoint after each. Keeps execution honest against the plan instead of drifting into a freehand build.
Use when work needs its own isolated checkout — parallel strands that would fight over files, or a risky change you want quarantined from the main tree. Gives each strand a real working directory on its own branch without re-cloning.
Use whenever the user says "use slipstream", "use superpowers", or starts any task in a project that has slipstream. A hard, always-on discipline that forces scoped reads over whole-file reads to save tokens, recalls memory before acting, and records what is durable every turn so memory grows constantly.
Use when a site needs to look designed rather than defaulted, before building sections: establish a cohesive design system of type scale, spacing, colour, radius and shadow tokens so every component shares one premium visual language.
Use when building the top of a landing page, to produce a high-impact hero with confident display type, a clear single call to action and balanced composition, the kind of opening a polished marketing site leads with.
| name | auth-rbac |
| description | Use when routes or actions must be gated by user role: gate routes and actions behind roles so only authorised users can perform them. |
| slipstream | {"category":"auth","requires":["auth-session"],"verification":{"kind":"test","description":"RBAC tests pass.","command":"pnpm --dir {{apiDir}} test"},"tags":["auth","security"]} |
Gate routes and actions behind roles so only authorised users can perform them.
Run the tests and confirm a user without the required role receives a 403 on a protected route.
