Every delivered app — the non-inferable business requirements + exact stack/brand choices every build must satisfy. Loads on every app/site build.
日本語の概要は準備中です。原文の説明を表示しています。
heymegabyte/agent-skills242026年10月11日 更新
無料GitHub で公開
trust-compliance
Legal, security, privacy, and deliverability requirements every delivered app must satisfy — legal pages, PII/deletion rights, CSP/Trusted-Types/Zod, AI-agent security, RFC7807 errors, email domain auth.
含まれるファイル（1）
- SKILL.md2.1 KB
SKILL.md（原文）
インストールする前に、エージェントに与えられる指示の中身を確認できます。
Trust, Security & Compliance — every app must satisfy
Legal & policy
- Ship real
/privacy,/terms,/accessibilitypages accurate to the ACTUAL data practices — never boilerplate that lies. Accessibility statement is ADA Title II / WCAG 2.2 AA-ready. - No dark patterns — honest defaults, no forced continuity, no confirm-shaming (Christ-like ethos).
Data & PII
- Collect the minimum PII needed; never log secrets or PII in plaintext; keep credentials server-side only.
- Honor user right-to-deletion and data export on request. State retention plainly.
Security controls (every app)
- CSP Level 3
strict-dynamic+ per-request nonce · Trusted Types · HSTS. No inline script without a nonce. - Zod validation at EVERY runtime boundary (env · API in/out · params · forms · webhooks · queue/DO messages · AI outputs) — validation is a security control, not just typing.
- Forms gated by Turnstile. All hyperlinks valid (no dead/hostile links).
- Tenant isolation:
org_idon every row + query; 404 (never 403) on cross-tenant access.
AI-agent security
- Treat all model/tool input as untrusted: defend against prompt injection; authorize every tool call; validate + schema-bind every AI output before use (Contract-First AI). Sandbox generated/risky code before it runs.
Errors (never leak internals)
- User-facing errors use RFC7807 envelopes:
code+correlationId+errors[]+ what-to-do-next. Never expose stack traces, SQL, or internal identifiers.
Email domain authentication
- Sending domain publishes SPF + DKIM + DMARC (BIMI where a VMC exists). These records live on the SENDING domain's zone (may differ from the site domain — surface any mismatch before staging).
レビュー
まだレビューはありません。使ってみた感想をお寄せください。
同じリポジトリのスキル
概要と使いどころ
Cloudflare-first platform selection. Decision trees for Workers, D1, R2, KV, DO, Queues, Vectorize, Containers, Sandboxes, Flagship, Agent Memory, Workflows v2. Default stack, override conditions, auth, data patterns, reliability.
日本語の概要は準備中です。原文の説明を表示しています。
heymegabyte/agent-skills242026年10月11日 更新
Extract real brands (Wayback for rebuilds). Copy system, headline/CTA rules, trust surfaces, legal pages, SEO+structured data, anti-AI-slop, microcopy, DESIGN.md, W3C DTCG tokens, pSEO 5 types, GEO/AI search.
日本語の概要は準備中です。原文の説明を表示しています。
heymegabyte/agent-skills242026年10月11日 更新
Implements features in vertical slices, always starting with homepage. Enforces anti-placeholder rules — no lorem ipsum, no TODO stubs, no gray boxes. Real content, real images, real interactions. TypeScript strict mode, Zod validation, and structured file organization.
日本語の概要は準備中です。原文の説明を表示しています。
heymegabyte/agent-skills242026年10月11日 更新
The consolidated, world-class Cloudflare + integrations reference — CF platform/data/AI-edge patterns, media pipeline, observability/growth, payments, and the site-generation pipeline. The non-inferable choices that build the greatest web apps.
日本語の概要は準備中です。原文の説明を表示しています。
heymegabyte/agent-skills242026年10月11日 更新
One-line-prompt → cinematic, gorgeous, functional, well-tested, deployed website. Pre-hydrated SPA + full PWA kit + JSON-LD rich snippets + third-party integrations. React 19+Vite default (Angular optional). 100 concrete improvements grouped into 10 categories that EVERY single-prompt site build must satisfy before being marked done. Trigger whenever the user says 'make a website for X', 'build a site for X', 'rebuild X.com', or any equivalent one-liner.
日本語の概要は準備中です。原文の説明を表示しています。
heymegabyte/agent-skills242026年10月11日 更新