Skill
preset-admin
Manage Preset teams, workspaces, memberships, invites, role identifiers, seat checks, and audit logs through direct Management API calls. Use only for direct…
@preset-ioView SkillDevelopment
Skill
/preset-embedded-rls
Review embedded analytics row-level security clauses, tenant filters, guest-token RLS rules, and external-viewer isolation for direct API workflows. Use only for direct API workflows; Do not use for MCP-only work.
Install
$ npx -y skills add preset-io/agent-skills --skill preset-embedded-rls --agent claude-codeHow it fires
How this skill gets triggered: by you, by Claude, or both.
- Fires itselfAuto-invocation. Claude auto-loads it when your prompt matches the work.Auto-invocation is when the right skill fires by itself at the right moment, driven by a FLOW.md router and a hook, instead of you invoking it by name. It is the difference between a skill being installed and a skill actually getting used.Read the full definition →
- You can call itInvoke it directly when you want it.
- Slash command
/preset-embedded-rls
Context preview
The summary Claude sees to decide when to auto-load this skill.
Review embedded analytics row-level security clauses, tenant filters, guest-token RLS rules, and external-viewer isolation for direct API workflows. Use only for direct API workflows; Do not use for MCP-only work.
SKILL.md
preset-embedded-rls.SKILL.mdname: preset-embedded-rls
description: Review embedded analytics row-level security clauses, tenant filters, guest-token RLS rules, and external-viewer isolation for direct API workflows. Use only for direct API workflows; Do not use for MCP-only work.
preset-embedded-rls
Use before guest-token creation when embedded viewers need row-level security.
Always
- Auth and conventions come from `preset-api` (JWT exchange, base URLs, Rison); resolve the workspace hostname through the Management API when it is not already known. Consult metadata skills only when column validation is required.
- Do not invent tenant identifiers, filters, dataset columns, or access rules.
- Treat RLS clauses as permission controls that can leak or hide customer data.
- Confirm every clause and intended viewer population before token creation.
- Do not validate with broad data-returning queries unless the user approves target and limit.
Decision Rules
- Classify embedded RLS review as plan-only safety work.
- Identify tenant and user filter safety issues.
- Require approval before clauses are used in token claims.
- Avoid mutating embedded RLS configuration.
Workflow Order
1. Inspect embedded RLS clauses. 2. Flag unsafe tenant and user filters. 3. Summarize approval requirements. 4. Stop before using clauses in tokens.
Retrieve
- Embedded RLS rule design and review: [references/embedded-rls-rules.md](references/embedded-rls-rules.md)
Read more
name: preset-embedded-rls description: Review embedded analytics row-level security clauses, tenant filters, guest-token RLS rules, and external-viewer isolation for direct API workflows. Use only for direct API workflows; Do not use for MCP-only work.
preset-embedded-rls
Use before guest-token creation when embedded viewers need row-level security.
Always
- Auth and conventions come from `preset-api` (JWT exchange, base URLs, Rison); resolve the workspace hostname through the Management API when it is not already known. Consult metadata skills only when column validation is required.
- Do not invent tenant identifiers, filters, dataset columns, or access rules.
- Treat RLS clauses as permission controls that can leak or hide customer data.
- Confirm every clause and intended viewer population before token creation.
- Do not validate with broad data-returning queries unless the user approves target and limit.
Decision Rules
- Classify embedded RLS review as plan-only safety work.
- Identify tenant and user filter safety issues.
- Require approval before clauses are used in token claims.
- Avoid mutating embedded RLS configuration.
Workflow Order
1. Inspect embedded RLS clauses. 2. Flag unsafe tenant and user filters. 3. Summarize approval requirements. 4. Stop before using clauses in tokens.
Retrieve
- Embedded RLS rule design and review: [references/embedded-rls-rules.md](references/embedded-rls-rules.md)
Ships withpreset-io-agent-skills
Agent guidance for working with Preset, Apache Superset, and Superset MCP tools. The skills work across Claude, OpenAI Codex, Cursor, GitHub Copilot, Snowflake Cortex Code CLI, and Gemini CLI from a single source.
Get the whole plugin
Other skills on preset-io-agent-skills.
@preset-ioView SkillSkill
preset-api
Prepare direct Preset API access: auth, JWT exchange, base URLs, pagination, Rison parameters, response handling, and shared API setup. Use only for direct API…
@preset-ioView SkillSkill
preset-cortex-agents
Use Snowflake Cortex Agent REST and SQL APIs for listing, describing, creating, updating, deleting, running agents, streaming responses, and SQL wrappers. Use…
@preset-ioView SkillSkill
preset-dashboards
Inspect Preset workspace dashboards, charts, dashboard composition, screenshots, thumbnails, chart data, and chart/dashboard operation routing through direct…
@preset-ioView SkillSkill
preset-database-connec…
Inspect or route Preset database connection configuration, validation, OAuth, upload, create, update, and delete workflows through direct Superset API calls.…
@preset-ioView SkillSkill
preset-datasets
Inspect Preset workspace datasets, database metadata, schemas, tables, columns, metrics, and dataset/database workflow routing through direct Superset API…
@preset-ioView Skill