skillboardUpdated every 6 hours
skillboardApplies n8n's RBAC scope decorators to REST endpoints. Use when creating a new @RestController, adding any @Get/@Post/@Put/@Patch/@Delete route to an existing controller, or reviewing endpoint authorization. Every authenticated endpoint must be gated by @ProjectScope or @GlobalScope.
b4d91bfProtect REST endpoints with RBAC Rule: every authenticated route on a MUST carry an access scope decorator. If you add a route without one, the IDOR/permission bypass is on you. Decision succeeds if the user has the scope globally OR in the project named in the URL . ignores project relations entirely. Both decorators come from . The middleware lives in ( ) and resolves access via in . Apply the decorator Conventions: One decorator per route, placed directly under the HTTP method decorator. Use…
Full body not shown for this license – view the source on GitHub →Copy a source-pinned command for your client. You run it yourself.
Destination: .claude/skills/protect-endpoints · pinned to the source commit
git clone https://github.com/n8n-io/n8n.git
cd n8n
git checkout b4d91bfe8a293106815b308a841e210562002735
mkdir -p ".claude/skills/protect-endpoints"
cp -r ".agents/skills/protect-endpoints" ".claude/skills/protect-endpoints"Review the source before running. This copies files into your project; it is not a one-click install and does not verify runtime safety.
sudo apt update && sudo apt install -y gitnpm install -g @anthropic-ai/claude-codegit clone https://github.com/n8n-io/n8n.git
cd n8n
git checkout b4d91bfe8a293106815b308a841e210562002735
mkdir -p ".claude/skills/protect-endpoints"
cp -r ".agents/skills/protect-endpoints" ".claude/skills/protect-endpoints"Destination: .claude/skills/protect-endpoints
Scanner static-checks@0.1.0 · commit b4d91bfe8a29. Static checks cannot prove runtime safety – review the source and the exact diff before installing. How checks work.
References parent-directory traversal, which can escape a target directory.
Evidence: ../· fingerprint fa08499e14d0113b