BuilderIO/packages/core/src/templates/workspace-core/.agents/skills/company-policies
packages/core/src/templates/workspace-core/.agents/skills/company-policies/SKILL.md
--- name: company-policies description: {{APP_TITLE}}-wide policies the agent must enforce for every app — data handling, PII, approval flows, compliance rules. --- # {{APP_TITLE}} Company Policies Every app in the workspace shares these policies. Read this skill before taking any action that touches customer data, external services, or deployed state. ## Data handling - **PII minimization.** Only load the fields you actually need. Never `SELECT *` on a table that contains customer records
$ install --global
skillsauthnpx skillsauth add BuilderIO/agent-native packages/core/src/templates/workspace-core/.agents/skills/company-policiesInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 16, 2026, 8:14 PM252.2s1 file scanned
SKILL.md
- name:
- company-policies
- description:
- {{APP_TITLE}}-wide policies the agent must enforce for every app — data handling, PII, approval flows, compliance rules.
{{APP_TITLE}} Company Policies
Every app in the workspace shares these policies. Read this skill before taking any action that touches customer data, external services, or deployed state.
Data handling
- PII minimization. Only load the fields you actually need. Never
SELECT *on a table that contains customer records. - No raw customer email in logs. Hash or redact before logging.
- Retention. Deleted records are soft-deleted first and purged by a scheduled job. Do not write actions that hard-delete customer data.
Third-party calls
- Allowlist only. Only call domains on the approved allowlist
(documented in the root
README.md). If an integration needs a new domain, surface a warning and wait for human approval before making the call. - Secrets come from
resolveCompanyCredential. Never hardcode. Never check secrets into git. Rotating a key in the central store updates every app on the next request.
Approval flows
- Destructive operations need a confirmation preview. Any action that modifies production data must first return a preview of the change (what will be created / updated / deleted) and wait for explicit user confirmation before executing.
Apply across apps
This skill is loaded automatically in every workspace app. If an
individual app needs different behavior, it can add a same-named skill
under its own .agents/skills/company-policies/SKILL.md and that copy
will win for that app only.
Related Skills
BuilderIO/booker
tools
VerifiedTrustedCommunity
Public booking flow — the state machine, animations, and URL/app-state sync.
108SKILL.mdUpdated Apr 19, 2026
BuilderIO/workflows
tools
VerifiedTrustedCommunity
Trigger-based automations — reminders, follow-ups, webhooks — across the booking lifecycle.
46SKILL.mdUpdated Apr 19, 2026
BuilderIO/team-scheduling
tools
VerifiedTrustedCommunity
Team event types, round-robin assignment, collective bookings, host weights, and no-show calibration.
46SKILL.mdUpdated Apr 19, 2026
BuilderIO/slot-engine
development
VerifiedTrustedCommunity
The pure `computeAvailableSlots` function — inputs, outputs, invariants, and debugging guide.
46SKILL.mdUpdated Apr 19, 2026