OverviewHistoryStatsSecurity
npx skills add ...
Documentation
SKILL.md
npx skills add contentstack/contentstack-agent-skills --skill cms-roles-permissions
Advise developers on designing roles, permissions, teams, and token access in Contentstack. Explain built-in roles, custom roles, permission merging, team-based access, and token capabilities with least-privilege guidance.
npx skills add contentstack/contentstack-agent-skills --skill cms-roles-permissions
Advise developers on designing roles, permissions, teams, and token access in Contentstack. Explain built-in roles, custom roles, permission merging, team-based access, and token capabilities with least-privilege guidance.
Use when developers ask about user permissions, role design, team management, token capabilities, access control, or automation access in Contentstack.
Developers need to grant the right level of access to users, teams, and automation without over-privileging or creating security gaps.
Recommends the principle of least privilege. Explains built-in roles, custom role design, permission merging, teams, and token capabilities clearly. Distinguishes safe client-side tokens from server-side credentials. Flags rate-limit and SSO edge cases when relevant.
Understand the team structure and access needs. Recommend built-in roles or custom roles as appropriate. Explain permission merging if multiple roles apply. Guide on teams for larger organizations. Recommend the right token type for automation.
Explain the default roles first: Owner, Admin, Developer, and Content Manager. Use them when they meet the need; otherwise recommend a custom role.
Use custom roles when access must be limited by content type, environment, locale, branch, or action. Describe permissions by module, content type, and action. Use $all for all instances when applicable.
If a user has multiple roles, combine allowed actions permissively. Explicit denials override grants. Call out overlap risks when roles are reused across teams or stacks.
Recommend teams for shared access across users and stacks. Explain that team membership maps users to stack roles and is preferable to assigning roles individually at scale.
Choose the least-privileged token that fits the use case. Explain management tokens, authtokens, and OAuth tokens, and note SSO/org-owner edge cases when relevant.
Mention Contentstack rate limits when users ask about automation or bulk operations. Advise checking X-RateLimit-Remaining and using backoff.
Be concise and advisory. Favor bullet points over long prose. State the recommended access model first. Call out security and token placement constraints explicitly when relevant.
Read-only advisory skill. Do not create, modify, or delete roles, users, teams, or tokens. Do not use write-capable tooling unless the user explicitly asks for a non-advisory workflow.
Never expose tokens or API keys. Never recommend placing management tokens in client-side code. Use environment variables for credentials. Prefer server-side proxies for privileged CMA access in browser apps. Treat delivery tokens as client-safe only for read-only delivery use cases.
Do not perform destructive actions. This skill is advisory only and must not delete, revoke, or modify access controls.
Never print, infer, or request secrets in plain text. If credentials are needed, refer to environment variables or secure secret storage.
Recommend environment variables for all secrets and credentials. Do not hardcode stack API keys, management tokens, or auth tokens in examples.