@probo/skills 0.4.0 → 0.5.0

package/.agents/plugins/marketplace.json

@@ -6,7 +6,7 @@
   "plugins": [
     {
       "name": "probo",
-      "description": "Open-source compliance workflows powered by Probo MCP",
+      "description": "Open-source compliance workflows for the Probo MCP API, plus the using-prb CLI skill",
       "source": {
         "source": "local",
         "path": "./"

package/.claude-plugin/marketplace.json

@@ -8,7 +8,7 @@
   "plugins": [
     {
       "name": "probo",
-      "description": "Open-source compliance workflows powered by Probo MCP",
+      "description": "Open-source compliance workflows for the Probo MCP API, plus the using-prb CLI skill",
       "source": {
         "source": "npm",
         "package": "@probo/skills"

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "probo",
-  "version": "0.4.0",
-  "description": "Open-source compliance workflows powered by Probo MCP (Claude Code, Codex, OpenCode)",
+  "version": "0.5.0",
+  "description": "Open-source compliance workflows and the using-prb CLI skill (Claude Code, Codex, OpenCode)",
   "author": {
     "name": "Probo Inc",
     "email": "hello@probo.com"

package/.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "probo",
-  "version": "0.4.0",
-  "description": "Open-source compliance workflows powered by Probo MCP (Codex, OpenCode, Claude Code)",
+  "version": "0.5.0",
+  "description": "Open-source compliance workflows and the using-prb CLI skill (Codex, OpenCode, Claude Code)",
   "author": {
     "name": "Probo Inc",
     "email": "hello@probo.com"

package/COMPATIBILITY.md

@@ -40,6 +40,16 @@ Both documents declare
 `https://agent-plugins.org/schemas/1.0.0/{plugin,mcp}.schema.json`, and the
 spec requires the two versions to match.
 
+`using-prb` is a skill in that same `skills/` directory. It describes the
+`prb` CLI and does not use the MCP servers. Install it from the repository
+pinned to the `@probo/skills` tag matching the installed CLI (see
+`CHANGELOG.md` for the version):
+
+```bash
+gh skill install getprobo/probo using-prb --pin @probo/skills/vX.Y.Z
+npx skills add "getprobo/probo#@probo/skills/vX.Y.Z" --skill using-prb
+```
+
 Commands, marketplace catalogs, and the client manifests are outside the v1
 format — Agent Plugins v1 standardizes only skills and MCP servers. Clients
 ignore the extra files.

package/README.md

@@ -1,10 +1,10 @@
 # @probo/skills
 
-Multi-agent compliance skills for open-source GRC workflows. Ships an
+Multi-agent skills for open-source GRC workflows and the `prb` CLI. Ships an
 [Agent Plugins 1.0.0](https://agent-plugins.org/) package: Agent
 Skills–compatible instructions plus portable MCP wiring to the [Probo MCP
 API](https://github.com/getprobo/probo/tree/main/pkg/server/api/mcp/v1) over
-OAuth 2.0.
+OAuth 2.0. `using-prb` is the CLI skill and does not use MCP.
 
 **Supported agents:** any Agent Plugins client, plus Claude Code, Codex,
 OpenCode, and Cursor through their own plugin or MCP configuration.
@@ -70,16 +70,28 @@ claude plugin install probo@probo
 claude --plugin-dir ./packages/skills
 ```
 
+### prb CLI
+
+`using-prb` lives in `skills/` next to the MCP workflows. It covers sign-in,
+organization choice, and record changes. Install it from the repository
+pinned to the `@probo/skills` tag that matches the installed `prb` (see
+`CHANGELOG.md` for the version). The binary does not embed a copy.
+
+```bash
+gh skill install getprobo/probo using-prb --pin @probo/skills/vX.Y.Z
+npx skills add "getprobo/probo#@probo/skills/vX.Y.Z" --skill using-prb
+```
+
 ## What's included
 
 | Component | Location | Purpose |
 | --- | --- | --- |
 | Manifest | `plugin.json` | Agent Plugins 1.0.0 plugin identity |
 | MCP | `mcp.json` | Portable hosted Probo servers |
-| Skills | `skills/` | Compliance workflows |
+| Skills | `skills/` | MCP compliance workflows, plus `using-prb` for the CLI |
 | Commands | `commands/` | `access-review`, `missing-signatures` — semi-auto workflows (Claude Code) |
 
-Skills: `/probo:<skill-name>` (e.g. `/probo:open-source-compliance`, `/probo:missing-signatures`).
+MCP skills: `/probo:<skill-name>` (e.g. `/probo:open-source-compliance`, `/probo:missing-signatures`).
 
 Commands: `/probo:<command-name>` (e.g. `/probo:access-review`, `/probo:missing-signatures`).
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@probo/skills",
-  "version": "0.4.0",
-  "description": "Multi-agent compliance skills for open-source GRC (Claude Code, Codex, OpenCode) powered by Probo MCP",
+  "version": "0.5.0",
+  "description": "Multi-agent skills for open-source GRC and the prb CLI (Claude Code, Codex, OpenCode, Cursor)",
   "private": false,
   "scripts": {
     "validate": "node scripts/validate.mjs",
@@ -38,7 +38,7 @@
   ],
   "license": "MIT",
   "devDependencies": {
-    "js-yaml": "^5.4.1"
+    "js-yaml": "^5.5.0"
   },
   "repository": {
     "type": "git",

package/plugin.json

@@ -1,8 +1,8 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "probo",
-  "version": "0.4.0",
-  "description": "Open-source compliance workflows powered by the Probo MCP API",
+  "version": "0.5.0",
+  "description": "Open-source compliance workflows for the Probo MCP API, plus the using-prb CLI skill",
   "author": {
     "name": "Probo Inc",
     "email": "hello@probo.com",

package/skills/open-source-compliance/SKILL.md

@@ -35,7 +35,7 @@ first.
 
 ### Control and obligation tracking
 
-1. List controls, measures, or obligations relevant to the user's question.
+1. List controls, internal controls, or obligations relevant to the user's question.
 2. Link evidence (documents, audits) where appropriate.
 3. Report gaps between required and implemented controls.
 

package/skills/using-prb/SKILL.md

@@ -0,0 +1,126 @@
+---
+name: using-prb
+description: Call the prb CLI without inventing flags. Use when an agent runs prb, signs in, chooses an organization, or creates, lists, views, updates, or deletes Probo records such as frameworks, controls, risks, documents, tasks, assets, data, vendors, audits, findings, obligations, processing activities, rights requests, business functions, AI systems, or webhooks.
+compatibility: Requires the prb binary on PATH. Setting PROBO_HOST and PROBO_TOKEN lets every command skip login entirely. Otherwise `prb auth login` runs the device flow; it opens a browser when the session is interactive, and prints a URL and code to approve manually when it is not.
+---
+
+# Use prb
+
+`prb` is the Probo CLI. Prefer it over hand-written GraphQL. Command help is
+the source of truth for flags. This skill is the source of truth for how to
+call the CLI.
+
+Before the first call to a command in this session, read its help:
+
+```sh
+prb <command> --help
+prb <command> <verb> --help
+```
+
+Pass only flags that appear there. Copy enum values from the help text.
+Read `references/commands.md` in this skill for the command groups. Required
+create flags are listed in `references/create.md`. Flag help wins when it
+disagrees with a reference.
+
+## Call shape
+
+1. Export `PROBO_NO_INTERACTIVE=1` so prb does not prompt. In that mode every
+   required flag must be present.
+2. Results go to stdout. Errors go to stderr and the process exits non-zero.
+   Do not treat stderr warnings as failure when the exit code is 0.
+3. Request JSON with `--json`. `--output json` and `-o json` are the same
+   choice. Combining `--json` with any other `--output` value fails.
+   `--json` is registered on list and view commands; a few create and
+   update commands have it too. Check `--help` to confirm it exists before
+   relying on it elsewhere.
+4. `list` is also `ls`.
+5. Command and flag names are kebab-case. The vendor command is
+   `prb third-party`. `tp` is its short alias.
+6. View, update, and delete take the resource id printed by create. That id
+   is the first token that parses as a Probo id.
+7. Update with only the id fails with `at least one field must be specified`.
+   Pass the fields that change.
+8. Delete in non-interactive mode requires `--yes`. Without it, prb exits
+   non-zero and deletes nothing.
+9. `--limit` / `-L` is the maximum number of rows to return; a list with
+   fewer matches returns fewer rows. It must be greater than 0.
+   stderr prints `Showing N of M` when more rows exist, and
+   `Next cursor: <cursor>` when another page exists. Repeat the same
+   command and filters with `--after <cursor>`. Do not treat one page as
+   the full set. On commands that expose it, `--order-direction` accepts
+   `ASC` or `DESC`.
+
+## Sign in
+
+Settle the host and the organization before any other `prb` command.
+
+1. Run `prb auth status`.
+2. An active host prints `(active)` and `Token: set` or `Token: not set`.
+   The command never prints the token. Do not ask the user to paste a token
+   into the chat when status already says `Token: set`.
+3. `PROBO_HOST` selects the host for this process. `PROBO_TOKEN` supplies the
+   bearer token. A token without a host is an error.
+4. Hosts without a scheme are HTTPS. A local server needs an explicit
+   `http://` URL, for example `http://localhost:8080`.
+5. When status shows no active host, or an active host with `Token: not
+   set`, run `prb auth login`. Pass `--hostname` when the user names a
+   region or a self-hosted instance (`eu.probo.com`, `us.probo.com`, or the
+   instance host). Pass `--org` when the user already knows the default
+   organization id.
+
+Then choose the organization:
+
+1. Run `prb org list --json`.
+2. Use the organization the user named, or the only organization in the list.
+3. When several organizations match, print the id and name of each and ask
+   which one to use.
+4. Pass that id as `--org` on later commands. `--organization` is the same
+   flag. Pass it once to `prb auth login --org` so it becomes the saved
+   default.
+5. A missing organization fails with `organization is required; pass --org or
+   --organization, or set a default with 'prb auth login'`.
+
+## Organization
+
+Commands that select an organization take `--org`. `--organization` sets the
+same value. Lists of a child record take the parent id instead: `control`
+takes `--framework`, `evidence` takes `--internal-control`, consent records
+and cookie categories take the banner, and access-review entries take the
+campaign.
+
+`connector connect --organization` is a boolean. The Probo organization id
+on that command is `--org`.
+
+## Change a record
+
+1. Pass the organization as `--org` or `--organization`. Controls are the
+   exception: pass `--framework` and omit both.
+2. Create with every required flag from `references/create.md`. The new id
+   is on stdout.
+3. `prb <command> view <id> --json` and confirm the field you wrote.
+4. Update with `prb <command> update <id>` plus at least one changed flag.
+5. Delete with `prb <command> delete <id> --yes` only after the user asked to
+   delete that record.
+
+Ids used as inputs:
+
+- `--owner` is a profile id from `prb user list --org <org> --json`.
+- `--framework` on audits and controls is a framework id from
+  `prb framework create` or `prb framework list --json`.
+- `--third-party-ids` takes vendor ids. The kebab-case flag is the one to
+  pass.
+
+Document title, type, and classification are fields of the document.
+`prb document view <id> --json` includes `title`.
+
+`prb webhook list` requires `--org`. Create takes `--url` and one or more
+`--event` flags. `--help` only shows example event names, not the full set.
+An invalid `--event` value returns an error listing every valid name; use
+that to confirm a name before retrying.
+
+## After writing
+
+Confirm the change with `prb <command> view <id> --json` or
+`prb <command> list --org <id> --json`. A deleted id is absent from the list.
+Controls are the exception from "Change a record": verify with
+`prb control list --framework <framework-id> --json`, not `--org`.

package/skills/using-prb/references/commands.md

@@ -0,0 +1,48 @@
+# prb command groups
+
+Run `prb <command> --help` before using a group. This list is the group name
+only.
+
+| Group | What it manages |
+| --- | --- |
+| `auth` | Login, logout, and status |
+| `org` | Organizations the caller can access |
+| `user` | People in an organization |
+| `config` | prb's local configuration file |
+| `context` | The organization context saved by `prb auth login` |
+| `framework` | Frameworks |
+| `control` | Controls inside a framework |
+| `internal-control` | Internal controls |
+| `soa` | Statement of applicability |
+| `risk` | Risks |
+| `risk-analysis` | Risk analysis diagrams |
+| `treatment-plan` | Treatment plans |
+| `task` | Tasks |
+| `document` | Documents |
+| `evidence` | Evidence |
+| `audit` | Audits |
+| `finding` | Findings |
+| `asset` | Assets |
+| `datum` | Data |
+| `third-party` | Vendors |
+| `processing-activity` | Processing activities |
+| `obligation` | Obligations |
+| `rights-request` | Data-subject requests |
+| `dpia` | Data protection impact assessments |
+| `tia` | Transfer impact assessments |
+| `business-function` | Business functions |
+| `ai-system` | AI systems |
+| `cookie-banner` | Cookie consent banners |
+| `cookie-category` | Cookie categories on a banner |
+| `consent-record` | Cookie consent records |
+| `tracker-pattern` | Tracker detection patterns |
+| `tracker-resource` | Detected tracker scripts and resources |
+| `resource-alias` | Aliases on compliance portal entries |
+| `webhook` | Webhook subscriptions |
+| `audit-log` | Audit log |
+| `connector` | External connectors |
+| `scim` | SCIM |
+| `device` | Devices |
+| `compliance-portal` | Compliance portal |
+| `employee-portal` | Employee portal |
+| `access-review` | Access reviews |

package/skills/using-prb/references/create.md

@@ -0,0 +1,32 @@
+# Required create flags
+
+An organization is required on every command in this table except
+`control`. Pass `--org` or `--organization` (the same flag), or rely on the
+default saved by `prb auth login --org`.
+`prb <command> create --help` is authoritative when a row is stale.
+
+| Command | Required flags besides `--org` |
+| --- | --- |
+| `framework create` | `--name` |
+| `control create` | `--framework`, `--section-title`, `--name`, `--description` |
+| `task create` | `--name`, `--priority` |
+| `document create` | `--title`, `--document-type`, `--classification` |
+| `asset create` | `--name`, `--asset-type`, `--amount`, `--owner`, `--data-types-stored` |
+| `datum create` | `--name`, `--data-classification`, `--owner` |
+| `risk create` | `--name`, `--category` |
+| `processing-activity create` | `--name`, `--role`, `--lawful-basis`, `--special-or-criminal-data`, `--data-protection-impact-assessment`, `--transfer-impact-assessment` |
+| `obligation create` | `--area`, `--source`, `--status`, `--type`, `--owner` |
+| `rights-request create` | `--data-subject`, `--type`, `--state` |
+| `internal-control create` | `--name`, `--category` |
+| `business-function create` | `--name`, `--classification`, `--mtd-minutes`, `--rto-minutes`, `--rpo-minutes` |
+| `ai-system create` | `--name`, `--status`, `--risk-classification` |
+| `audit create` | `--name`, `--framework` (repeat `--framework` for another framework) |
+| `finding create` | `--kind`, `--status`, `--priority` |
+| `third-party create` | `--name`, `--category` |
+| `webhook create` | `--url`, `--event` (repeat `--event` for another event) |
+
+`control list` takes `--framework` and does not take `--org`. Other lists take
+`--org`.
+
+`--amount` is an integer of at least 1. Business-function minute flags are
+integers. `--international-transfers` defaults to false and can be omitted.