用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/trycompai/comp --skill audit-rbac命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Run all audit checks (RBAC, hooks, design system, tests) and verify build
Check code for the most common, high-risk security vulnerabilities (broken access control, tenant isolation, injection, secrets, SSRF, auth/session, unsafe file handling, mass assignment) before it ships. Use after editing any API controller, guard, or auth code (apps/api/src/auth/**), a Prisma schema/query, a file-upload/webhook handler, or before committing/pushing security-sensitive changes.
How to reuse ANY integration check's results in a feature via the universal CheckResultsService (apps/api integration-platform). Use whenever a feature needs data produced by an integration check — "show 2FA status on People", "surface AWS S3 findings in X", "reuse a check's results", "per-user/per-resource results from a connected integration", "which integrations feed task T". Read this BEFORE writing your own IntegrationCheckResult / CheckRunRepository query — don't hand-roll it.
基于 SOC 职业分类
正在显示 SKILL.md
| name | audit-rbac |
| description | Audit & fix RBAC and audit log compliance in API endpoints and frontend components |
Audit the specified files or directories for RBAC and audit log compliance. Fix every issue found immediately.
apps/api/src/)@RequirePermission('resource', 'action'). If missing, add it.@RequirePermission('resource', 'read'). If missing, add it./me/preferences) may skip @RequirePermission — authentication via HybridAuthGuard is sufficient.@Controller({ path: 'name', version: '1' }), NOT @Controller('v1/name'). If wrong, fix it.@UseGuards(HybridAuthGuard, PermissionGuard) at controller or endpoint level. Never skip PermissionGuard.@Public() — no auth required.apps/app/src/)usePermissions from @/hooks/use-permissions. If not:
{hasPermission('resource', 'create') && <Button>...disabled={!canUpdate}disabled={!canUpdate}role.includes('admin')) — use hasPermission().canAccessRoute(permissions, 'routeSegment').requireRoutePermission('segment', orgId) server-side.organization, member, control, evidence, policy, risk, vendor, task, framework, audit, finding, questionnaire, integration, apiKey, trust, pentest, app, compliance
app:read gates compliance dashboard; pentest:read gates security productpolicy, compliance) do NOT grant app access$ARGUMENTS (or scan the directory)bunx turbo run typecheck --filter=@trycompai/api --filter=@trycompai/app