Elysia API Routes
biersoeckli/QuickStack
Create and update QuickStack Elysia REST API routes using the project's established /api/v1 route conventions.
Audit & fix RBAC and audit log compliance in API endpoints and frontend components
Install Audit Rbac
$ npx skills add trycompai/comp --skill audit-rbac -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install trycompai/comp audit-rbac --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/trycompai/comp.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.agents/skills/audit-rbac .claude/skills/audit-rbac && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "audit-rbac" agent skill from https://github.com/trycompai/comp/tree/main/.agents/skills/audit-rbac into .claude/skills/audit-rbac/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "audit-rbac", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/trycompai/comp/tree/main/.agents/skills/audit-rbacType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add trycompai/comp --skill audit-rbac -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install trycompai/comp audit-rbac --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/trycompai/comp.git skills-src && mkdir -p .agents/skills && cp -r skills-src/.agents/skills/audit-rbac .agents/skills/audit-rbac && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "audit-rbac" agent skill from https://github.com/trycompai/comp/tree/main/.agents/skills/audit-rbac into .agents/skills/audit-rbac/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "audit-rbac", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add trycompai/comp --skill audit-rbac -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install trycompai/comp audit-rbac --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/trycompai/comp.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/.agents/skills/audit-rbac .cursor/skills/audit-rbac && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "audit-rbac" agent skill from https://github.com/trycompai/comp/tree/main/.agents/skills/audit-rbac into .cursor/skills/audit-rbac/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "audit-rbac", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/trycompai/comp.git --path .agents/skills/audit-rbac--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add trycompai/comp --skill audit-rbac -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install trycompai/comp audit-rbac --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/trycompai/comp.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/.agents/skills/audit-rbac .gemini/skills/audit-rbac && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "audit-rbac" agent skill from https://github.com/trycompai/comp/tree/main/.agents/skills/audit-rbac into .gemini/skills/audit-rbac/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "audit-rbac", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install trycompai/comp audit-rbacInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add trycompai/comp --skill audit-rbac -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/trycompai/comp.git skills-src && mkdir -p .github/skills && cp -r skills-src/.agents/skills/audit-rbac .github/skills/audit-rbac && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "audit-rbac" agent skill from https://github.com/trycompai/comp/tree/main/.agents/skills/audit-rbac into .github/skills/audit-rbac/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "audit-rbac", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add trycompai/comp --skill audit-rbac -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install trycompai/comp audit-rbac --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/trycompai/comp.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/.agents/skills/audit-rbac .opencode/skills/audit-rbac && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "audit-rbac" agent skill from https://github.com/trycompai/comp/tree/main/.agents/skills/audit-rbac into .opencode/skills/audit-rbac/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "audit-rbac", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
audit-rbac- GitHub stars
- 2k
- Token cost
- ~659 tokens
- SKILL.md length
- 280 words
- Files
- 1
- Skills in repo
- 31
- Repo updated
- First seen
- Licence
- AGPL-3.0
At a glance
Audit & fix RBAC and audit log compliance in API endpoints and frontend components
- Works in 6 steps: Every mutation endpoint (POST, PATCH,… → Read endpoints (GET) should have… → Self-endpoints (e.g., /me/preferences)… → …
- Tasks that involve Authorization and RBAC
- SKILL.md covers Rules and Process
- Calls bunx
What it does
Audit Rbac is an agent skill from trycompai/comp. Audit & fix RBAC and audit log compliance in API endpoints and frontend components
Its SKILL.md is about 660 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in Backend & APIs, covering Authorization and RBAC and REST APIs. The repository describes itself as: AI Native platform to get companies compliant - Vanta & Drata Alternative. The licence is AGPL-3.0.
When your agent uses it
- Tasks that involve Authorization and RBAC
- Tasks that involve REST APIs
Example prompts
- “/audit-rbac”
Workflow steps
6 steps, taken from the first numbered list in SKILL.md.
- Every mutation endpoint (POST, PATCH, PUT, DELETE) MUST have @RequirePermission('resource', 'action'). If missing, add it.
- Read endpoints (GET) should have @RequirePermission('resource', 'read'). If missing, add it.
- Self-endpoints (e.g., /me/preferences) may skip @RequirePermission — authentication via HybridAuthGuard is sufficient.
- Controller format: Must use @Controller({ path: 'name', version: '1' }), NOT @Controller('v1/name'). If wrong, fix it.
- Guards: Use @UseGuards(HybridAuthGuard, PermissionGuard) at controller or endpoint level. Never skip PermissionGuard.
- Webhooks: External webhook endpoints use @Public() — no auth required.
What it can do on your machine
Read from SKILL.md and the folder at commit 1bf4d52. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
bunx
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md. Its commands use bunx, which can reach the network depending on how they are called.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Audit Rbac loads about 659 tokens when it runs. Until then it costs about 23 tokens; SKILL.md has 280 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from trycompai/comp at commit 1bf4d52, republished under its AGPL-3.0 licence (© trycompai). 280 words, ~659 tokens.
Download SKILL.mdSave it as
.claude/skills/audit-rbac/SKILL.md (or your agent's skills folder).- name
- audit-rbac
- description
- Audit & fix RBAC and audit log compliance in API endpoints and frontend components
Audit the specified files or directories for RBAC and audit log compliance. Fix every issue found immediately.
Rules
API Endpoints (NestJS — apps/api/src/)
- Every mutation endpoint (POST, PATCH, PUT, DELETE) MUST have
@RequirePermission('resource', 'action'). If missing, add it. - Read endpoints (GET) should have
@RequirePermission('resource', 'read'). If missing, add it. - Self-endpoints (e.g.,
/me/preferences) may skip@RequirePermission— authentication viaHybridAuthGuardis sufficient. - Controller format: Must use
@Controller({ path: 'name', version: '1' }), NOT@Controller('v1/name'). If wrong, fix it. - Guards: Use
@UseGuards(HybridAuthGuard, PermissionGuard)at controller or endpoint level. Never skip PermissionGuard. - Webhooks: External webhook endpoints use
@Public()— no auth required.
Frontend Components (apps/app/src/)
- Every mutation element (button, form submit, toggle, switch, file upload) MUST be gated with
usePermissionsfrom@/hooks/use-permissions. If not:- Create/Add buttons: Wrap with
{hasPermission('resource', 'create') && <Button>... - Edit/Delete in dropdown menus: Wrap the menu item
- Inline form fields on detail pages: Add
disabled={!canUpdate} - Status/property selectors: Add
disabled={!canUpdate}
- Create/Add buttons: Wrap with
- Actions columns in tables: hide entire column when user lacks write permission.
- No manual role string parsing (
role.includes('admin')) — usehasPermission(). - Nav items: gate with
canAccessRoute(permissions, 'routeSegment'). - Page-level: call
requireRoutePermission('segment', orgId)server-side.
Permission Resources
organization, member, control, evidence, policy, risk, vendor, task, framework, audit, finding, questionnaire, integration, apiKey, trust, pentest, app, compliance
Multi-Product RBAC
- Products (compliance, pen testing) are org-level feature flags — NOT RBAC
app:readgates compliance dashboard;pentest:readgates security product- Custom roles can grant access to any combination of resources
- Portal-only resources (
policy,compliance) do NOT grant app access
Process
- Read files specified in
$ARGUMENTS(or scan the directory) - Check each rule above
- Fix every violation immediately — don't just report
- Run typecheck to verify:
bunx turbo run typecheck --filter=@trycompai/api --filter=@trycompai/app
© trycompai, AGPL-3.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
Just SKILL.md in .agents/skills/audit-rbac of trycompai/comp.
Open the folder on GitHubat commit 1bf4d52
Compare with similar skills
Audit Rbac next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Audit Rbac this skilltrycompai/comp | 2k | — | ~659 | Automated safety check: Pass | AGPL-3.0 | |
| Elysia API Routesbiersoeckli/QuickStack | 361 | — | ~1.1k | Automated safety check: Pass | GPL-3.0 | |
| API Auditbriiirussell/cybersecurity-skills | 412 | — | ~2.8k | Automated safety check: Notes | MIT | |
| Shadmin CLIahaodev/shadmin | 174 | — | ~1.1k | Automated safety check: Notes | MIT | |
| API Featuregocronx-team/gocron | 808 | — | ~1.2k | Automated safety check: Pass | MIT | |
| Discover APIrand/cc-polymath | 181 | 1 repos | ~1.5k | Automated safety check: Pass | MIT |
Similar skills
API Audit
briiirussell/cybersecurity-skills
Audit REST, GraphQL, and RPC APIs against the OWASP API Security Top 10 (2023).
Shadmin CLI
ahaodev/shadmin
A skill your agent uses when the user asks to query Shadmin admin platform resources (users, roles, menus, registered API resources) from a terminal — for example "list shadmin users", "show shadmin…
API Feature
gocronx-team/gocron
Implement or review an end-to-end gocron HTTP API change. An agent skill from gocronx-team/gocron.
Discover API
rand/cc-polymath
Automatically discover API design skills when working with REST APIs, GraphQL schemas, API authentication, OAuth, JWT, rate limiting, API versioning, error handling, or endpoint design.
Project Map
gjovanovicst/golang-auth-api
Complete module inventory of the Auth API project with file paths, dependencies, and architecture overview.
More from trycompai/comp
All 31 skills in this repoAPI Endpoint Contract
trycompai/comp
The contract every new or modified API endpoint must follow so it is correct for the public OpenAPI spec, the MCP server (npm @trycompai/mcp-server), the ValidationPipe, and the docs.
Check Results Service
trycompai/comp
How to reuse ANY integration check's results in a feature via the universal CheckResultsService (apps/api integration-platform).
Data
trycompai/comp
A skill your agent uses when implementing data fetching, API calls, server/client components, or SWR hooks
Diagnose Generation Failure
trycompai/comp
A skill your agent uses when SDK generation failed or seeing errors.
Forms
trycompai/comp
A skill your agent uses when building forms - covers React Hook Form, Zod validation, and form patterns
Code
trycompai/comp
A skill your agent uses when writing TypeScript/React code - covers type safety, component patterns, and file organization
Related
Categories
Questions about Audit Rbac
What does Audit Rbac do?
Audit & fix RBAC and audit log compliance in API endpoints and frontend components. Audit Rbac is an agent skill from trycompai/comp.
When should I use Audit Rbac?
Audit Rbac fits situations like: tasks that involve Authorization and RBAC; tasks that involve REST APIs.
How do I install Audit Rbac in Claude Code?
Run `npx skills add trycompai/comp --skill audit-rbac -a claude-code`. Or copy the skill folder (.agents/skills/audit-rbac in trycompai/comp) into .claude/skills/audit-rbac in your project. Claude Code loads it when a task matches its description.
How do I install Audit Rbac in Codex?
Run `npx skills add trycompai/comp --skill audit-rbac -a codex`. Or copy the skill folder (.agents/skills/audit-rbac in trycompai/comp) into .agents/skills/audit-rbac in your project. Codex loads it when a task matches its description.
Can I use Audit Rbac in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add trycompai/comp --skill audit-rbac -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/audit-rbac, .gemini/skills/audit-rbac, .github/skills/audit-rbac and .opencode/skills/audit-rbac in your project.
What does Audit Rbac need to run?
Going by SKILL.md and its folder, Audit Rbac needs the command-line tools its instructions call (bunx).
Does Audit Rbac access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Audit Rbac safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Audit Rbac use?
Audit Rbac is published under the AGPL-3.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Audit Rbac use?
About 659 tokens (SKILL.md is roughly 2.6k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Audit Rbac?
Skills that share tags, products or a category with Audit Rbac: Elysia API Routes (biersoeckli/QuickStack, 361 stars), API Audit (briiirussell/cybersecurity-skills, 412 stars), Shadmin CLI (ahaodev/shadmin, 174 stars) and API Feature (gocronx-team/gocron, 808 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Audit Rbac?
trycompai (a GitHub organization) maintains it in trycompai/comp, which has 2,016 GitHub stars. The repository holds 31 skills in this directory. The repository was last updated on October 2, 2026.
Source: trycompai/comp on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.