Skip to content
cccskills
FreePublished on GitHub

trust-compliance

Legal, security, privacy, and deliverability requirements every delivered app must satisfy — legal pages, PII/deletion rights, CSP/Trusted-Types/Zod, AI-agent security, RFC7807 errors, email domain auth.

The English summary is being prepared. Showing the original description.

See how to install

Files included (1)

  • SKILL.md2.1 KB

SKILL.md (original)

Review the instructions the agent will receive before you install.

Trust, Security & Compliance — every app must satisfy

Legal & policy

  • Ship real /privacy, /terms, /accessibility pages accurate to the ACTUAL data practices — never boilerplate that lies. Accessibility statement is ADA Title II / WCAG 2.2 AA-ready.
  • No dark patterns — honest defaults, no forced continuity, no confirm-shaming (Christ-like ethos).

Data & PII

  • Collect the minimum PII needed; never log secrets or PII in plaintext; keep credentials server-side only.
  • Honor user right-to-deletion and data export on request. State retention plainly.

Security controls (every app)

  • CSP Level 3 strict-dynamic + per-request nonce · Trusted Types · HSTS. No inline script without a nonce.
  • Zod validation at EVERY runtime boundary (env · API in/out · params · forms · webhooks · queue/DO messages · AI outputs) — validation is a security control, not just typing.
  • Forms gated by Turnstile. All hyperlinks valid (no dead/hostile links).
  • Tenant isolation: org_id on every row + query; 404 (never 403) on cross-tenant access.

AI-agent security

  • Treat all model/tool input as untrusted: defend against prompt injection; authorize every tool call; validate + schema-bind every AI output before use (Contract-First AI). Sandbox generated/risky code before it runs.

Errors (never leak internals)

  • User-facing errors use RFC7807 envelopes: code + correlationId + errors[] + what-to-do-next. Never expose stack traces, SQL, or internal identifiers.

Email domain authentication

  • Sending domain publishes SPF + DKIM + DMARC (BIMI where a VMC exists). These records live on the SENDING domain's zone (may differ from the site domain — surface any mismatch before staging).

Reviews

No reviews yet. Tell others what you thought.

Comments

No login needed. Share how it worked for you, ask a question, or note where it did not run.

No comments yet. Be the first to write one.

Comments are published right away. Do not include personal information such as email addresses or phone numbers. Up to 2 URLs.

0 / 1,000 characters

This form is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.

More skills from this repository

Every delivered app — the non-inferable business requirements + exact stack/brand choices every build must satisfy. Loads on every app/site build.

The English summary is being prepared. Showing the original description.

heymegabyte/agent-skills24Updated Oct 11, 2026

Cloudflare-first platform selection. Decision trees for Workers, D1, R2, KV, DO, Queues, Vectorize, Containers, Sandboxes, Flagship, Agent Memory, Workflows v2. Default stack, override conditions, auth, data patterns, reliability.

The English summary is being prepared. Showing the original description.

heymegabyte/agent-skills24Updated Oct 11, 2026

Extract real brands (Wayback for rebuilds). Copy system, headline/CTA rules, trust surfaces, legal pages, SEO+structured data, anti-AI-slop, microcopy, DESIGN.md, W3C DTCG tokens, pSEO 5 types, GEO/AI search.

The English summary is being prepared. Showing the original description.

heymegabyte/agent-skills24Updated Oct 11, 2026

Implements features in vertical slices, always starting with homepage. Enforces anti-placeholder rules — no lorem ipsum, no TODO stubs, no gray boxes. Real content, real images, real interactions. TypeScript strict mode, Zod validation, and structured file organization.

The English summary is being prepared. Showing the original description.

heymegabyte/agent-skills24Updated Oct 11, 2026

The consolidated, world-class Cloudflare + integrations reference — CF platform/data/AI-edge patterns, media pipeline, observability/growth, payments, and the site-generation pipeline. The non-inferable choices that build the greatest web apps.

The English summary is being prepared. Showing the original description.

heymegabyte/agent-skills24Updated Oct 11, 2026

One-line-prompt → cinematic, gorgeous, functional, well-tested, deployed website. Pre-hydrated SPA + full PWA kit + JSON-LD rich snippets + third-party integrations. React 19+Vite default (Angular optional). 100 concrete improvements grouped into 10 categories that EVERY single-prompt site build must satisfy before being marked done. Trigger whenever the user says 'make a website for X', 'build a site for X', 'rebuild X.com', or any equivalent one-liner.

The English summary is being prepared. Showing the original description.

heymegabyte/agent-skills24Updated Oct 11, 2026

See all skills by heymegabyte

Report a problem with this skill