agentmods.dev

violet: Skill for Claude Code

.agents/skills/permission-points/SKILL.md

permission-points is a skill for Claude Code, Codex from VOD-Studio/violet. It costs 52 tokens per session (890 once invoked), scanned A, original, MIT.

Guidance for designing permission points in role-based access control (RBAC), which decides what different user roles may see or do. It defines naming, granularity, route checks, application checks, migrations, and cleanup.

In plain words
What is it for?
Use it when adding, changing, removing, seeding, or connecting permissions to routes, services, admin navigation, and admin pages.
Why use it?
It helps prevent permissions from being too broad, inconsistently named, missing from the database, or absent from parts of the user interface.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one. Also seen: installed under .agents/ (shared by several agents).

This is VOD-Studio/violet's own configuration. It tells Claude Code and Codex how to work on violet itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything violet configures →

not rated 4repo yesterday A scan 52 tokens original MIT
View source ↗ VOD-Studio/violet xunrua.top
Reuse

Borrowing it

Nothing to install: this file belongs to VOD-Studio/violet. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/VOD-Studio/violet/release/2.0/.agents/skills/permission-points/SKILL.md
Clone the repo
git clone --depth 1 https://github.com/VOD-Studio/violet

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for permission-points

README.md
[![agentmods](https://agentmods.dev/badge/skills/vod-studio/violet/permission-points/github.svg)](https://agentmods.dev/skills/vod-studio/violet/permission-points)
Your own site
<a href="https://agentmods.dev/skills/vod-studio/violet/permission-points"><img src="https://agentmods.dev/badge/skills/vod-studio/violet/permission-points/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for permission-points

Your own site · 80×15
<a href="https://agentmods.dev/skills/vod-studio/violet/permission-points"><img src="https://agentmods.dev/badge/skills/vod-studio/violet/permission-points.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 52 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 890 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00052 $0.00890
Opus 5.5 $0.00021 $0.00356
Sonnet 5.5 $0.00010 $0.00178
Haiku 4.5 $0.00005 $0.00089

Measured 2mo ago against content hash 987498911db1, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

permission-points scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.agents/skills/permission-points/SKILL.md · 43 lines

What it actually says

权限点设计规范

权限点格式 module:action：module 为名词，action 多词用连字符。格式与校验正则以仓库的权限实体源码为唯一真相（grep ParseCode / 权限码正则定位），不在此复述。

粒度判断树

按序判定：

  1. 有独立后台页面的 module，先按页面性质分两支：
    • 有独立管理对象（存在 CRUD 语义的资源，如文章/评论/用户）→ 必建 view（页面可见性 + 读接口共用）。
    • 纯聚合只读页（无管理对象，如后台概览/统计总览）→ 跟随所在区域门禁（如 admin:access），不单独建点。裁决标准是受众：已持区域门禁者看聚合数字不构成最小权限违规（无被迫升权）；仅当预期出现独立受众角色（如只读运营只看统计、不进其他管理页）时才建 xxx:view，属 additive 拆分（第 4 条）。
  2. 写操作默认合用一个 manage——前提：所有角色对该 module 的写操作总是同时授予，无拆分需求。
  3. 出现具体授权差异（存在「能 X 不能 Y」的角色需求）时才拆：
    • CRUD 语义用标准动词 create / update / delete；
    • 业务语义用精确动词（publish / approve / ban 等），不硬套 CRUD。
  4. 拆分是 additive（新权限点 seed 给原有角色，授权只增不减）；合并是 breaking（需回收已授权限）。宁粗勿细，等需求出现再拆。
  5. manage 遮蔽实际能力——一旦某 module 出现部分授予需求，立即拆成显式动词，不往 manage 上叠语义。

新增权限点同步清单

  1. 常量：权限码预定义常量表（domain 层；项目无此表则建立）加新码。
  2. 迁移：新建 add-permission 迁移，以仓库最近一个同类迁移为模板（INSERT 权限 + 挂 menu/分组 + seed 默认角色，均带幂等保护）。
  3. 后端引用：路由权限中间件与应用层校验一律引用常量，不写字符串字面量。
  4. 前端：后台导航配置的权限数组 + 页面内权限门控 hook / guard。

四层全部落地才算完成；漏前端会让无权限用户看到入口，漏迁移会让常量指向不存在的权限点。

鉴权位置

  • 路由权限中间件管模块入口（整组端点的粗门禁）。
  • 「作者本人 or 持某权限」的双轨判断放应用层 service：路由不挂中间件，service 内校验放行作者或权限持有者。

删除权限点

功能下线时反向清理，迁移按外键依赖顺序：先删角色关联，再删孤立分组节点，最后删权限点行；{up,down}.sql 成对。确认路由与应用层无引用后删常量，构建验证；前端导航与门控调用点同步移除。

拆分 manage（判断树第 5 条）= 先按同步清单新增动词权限点并 seed 给原有角色，引用点全部切换后，旧 manage 若无消费方按上述流程删除。

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2mo ago First seen · 43 lines · 52 tokens per session scan A 987498911db1

Subscribe to this mod's changes

permission-points is a skill published in the GitHub repository VOD-Studio/violet (4 stars, last pushed yesterday), licensed MIT. It adds 52 tokens to every session and 890 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

ChiSecurityblogdddgomcpmodel-context-protocol
Related

permission-points compared with skills from other repositories

permission-points next to 6 skills from other repositories
ModTypeStarsLast pushLicenceScanTokensWorks with
permission-pointsVOD-Studio/violetSkill4yesterdayMITA52Claude Code, Codex
audit-network-securitygordcurrie/unifi-mcpSkill215d agoMITA81Claude Code, Codex
unifi-networkgordcurrie/unifi-mcpSkill215d agoMITA111Claude Code, Codex
dark-memoryOpita-Code/dark-memory-mcpSkill14d agononeA353Claude Code, Codex
vibe-loop-gitOpita-Code/dark-memory-mcpSkill14d agononeA0Claude Code, Codex
opencodeOpita-Code/dark-memory-mcpSkill14d agononeA0Claude Code, Codex
claude-codeOpita-Code/dark-memory-mcpSkill14d agononeA0Claude Code, Codex