preset-admin
Manage Preset teams, workspaces, memberships, invites, role identifiers, seat checks, and audit logs through direct Management…
@preset-ioInstall SkillDevelopment
Skill
/preset-embedded-rls
Review embedded analytics row-level security clauses, tenant filters, guest-token RLS rules, and external-viewer isolation for direct API workflows. Use only for direct API workflows; Do not use for MCP-only work.
Claude Code
$ npx -y skills add preset-io/agent-skills --skill preset-embedded-rls --agent claude-code
Codex
$ npx skills add preset-io/agent-skills --skill preset-embedded-rls -a codex -y
Cursor
$ npx skills add preset-io/agent-skills --skill preset-embedded-rls -a cursor -y
Gemini CLI
$ npx skills add preset-io/agent-skills --skill preset-embedded-rls -a gemini-cli -y
GitHub Copilot
$ npx skills add preset-io/agent-skills --skill preset-embedded-rls -a github-copilot -y
OpenCode
$ npx skills add preset-io/agent-skills --skill preset-embedded-rls -a opencode -y
Windsurf
$ npx skills add preset-io/agent-skills --skill preset-embedded-rls -a windsurf -y
SKILL.md
preset-embedded-rls.SKILL.mdname: preset-embedded-rls
description: Review embedded analytics row-level security clauses, tenant filters, guest-token RLS rules, and external-viewer isolation for direct API workflows. Use only for direct API workflows; Do not use for MCP-only work.
preset-embedded-rls
Use before guest-token creation when embedded viewers need row-level security.
Always
- Auth and conventions come from `preset-api` (JWT exchange, base URLs, Rison); resolve the workspace hostname through the Management API when it is not already known. Consult metadata skills only when column validation is required.
- Do not invent tenant identifiers, filters, dataset columns, or access rules.
- Treat RLS clauses as permission controls that can leak or hide customer data.
- Confirm every clause and intended viewer population before token creation.
- Do not validate with broad data-returning queries unless the user approves target and limit.
Decision Rules
- Classify embedded RLS review as plan-only safety work.
- Identify tenant and user filter safety issues.
- Require approval before clauses are used in token claims.
- Avoid mutating embedded RLS configuration.
Workflow Order
1. Inspect embedded RLS clauses. 2. Flag unsafe tenant and user filters. 3. Summarize approval requirements. 4. Stop before using clauses in tokens.
Retrieve
- Embedded RLS rule design and review: [references/embedded-rls-rules.md](references/embedded-rls-rules.md)
Read more
name: preset-embedded-rls description: Review embedded analytics row-level security clauses, tenant filters, guest-token RLS rules, and external-viewer isolation for direct API workflows. Use only for direct API workflows; Do not use for MCP-only work.
preset-embedded-rls
Use before guest-token creation when embedded viewers need row-level security.
Always
- Auth and conventions come from `preset-api` (JWT exchange, base URLs, Rison); resolve the workspace hostname through the Management API when it is not already known. Consult metadata skills only when column validation is required.
- Do not invent tenant identifiers, filters, dataset columns, or access rules.
- Treat RLS clauses as permission controls that can leak or hide customer data.
- Confirm every clause and intended viewer population before token creation.
- Do not validate with broad data-returning queries unless the user approves target and limit.
Decision Rules
- Classify embedded RLS review as plan-only safety work.
- Identify tenant and user filter safety issues.
- Require approval before clauses are used in token claims.
- Avoid mutating embedded RLS configuration.
Workflow Order
1. Inspect embedded RLS clauses. 2. Flag unsafe tenant and user filters. 3. Summarize approval requirements. 4. Stop before using clauses in tokens.
Retrieve
- Embedded RLS rule design and review: [references/embedded-rls-rules.md](references/embedded-rls-rules.md)
Ships withagent-skills
Agent guidance for working with Preset, Apache Superset, and Superset MCP tools. The skills are authored once and load across every supported agent client — see Supported clients.
1329 skills
Stars on GitHub
Momentum
- stars in total
- 13
Other skills on agent-skills.
@preset-ioInstall Skillpreset-api
Prepare direct Preset API access: auth, JWT exchange, base URLs, pagination, Rison parameters, response handling, and shared API…
@preset-ioInstall Skillpreset-dashboards
Inspect Preset workspace dashboards, charts, dashboard composition, screenshots, thumbnails, chart data, and chart/dashboard…
@preset-ioInstall Skillpreset-database-connec…
Inspect or route Preset database connection configuration, validation, OAuth, upload, create, update, and delete workflows…
@preset-ioInstall Skillpreset-datasets
Inspect Preset workspace datasets, database metadata, schemas, tables, columns, metrics, and dataset/database workflow routing…
@preset-ioInstall Skillpreset-destructive-imp…
Review destructive, overwrite-capable, sparse-update, all-assets restore, database import, and secret-bearing Preset import…
@preset-ioInstall SkillMore skills from other plugins.
Auto-invoked
brainstorming
You MUST use this before any creative work - creating features, building components, adding functionality, modifying behavior, or…
@obraInstall Skillask-matt
Ask which skill or flow fits your situation. A router over the skills in this repo.
@mattpocockInstall SkillAuto-invoked
Questions about preset-embedded-rls.
- Which coding agents can use preset-embedded-rls?
- preset-embedded-rls installs in Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot, OpenCode and Windsurf with the skills CLI, using each agent's flag shown on this page. Flowy's auto-invocation, which fires a skill when your prompt matches, runs in Claude Code only.