external/trailofbits-skills-curated/plugins/openai-netlify-deploy/skills/openai-netlify-deploy/SKILL.md
Deploy web projects to Netlify using the Netlify CLI (`npx netlify`). Use when the user asks to deploy, host, publish, or link a site/repo on Netlify, including preview and production deploys. Originally from OpenAI's curated skills catalog.
npx skillsauth add seikaikyo/dash-skills openai-netlify-deployInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Deploy web projects to Netlify using the Netlify CLI with intelligent detection of project configuration and deployment context.
This skill automates Netlify deployments by:
The skill uses the pre-authenticated Netlify CLI approach:
npx netlify statusnpx netlify loginAuthentication uses either:
netlify login opens browser for authenticationNETLIFY_AUTH_TOKEN environment variableCheck if the user is logged into Netlify:
npx netlify status
Expected output patterns:
If not authenticated, guide the user:
npx netlify login
This opens a browser window for OAuth authentication. Wait for user to complete login, then verify with netlify status again.
Alternative: API Key authentication
If browser authentication isn't available, users can set:
export NETLIFY_AUTH_TOKEN=your_token_here
Tokens can be generated at: https://app.netlify.com/user/applications#personal-access-tokens
From netlify status output, determine:
If already linked → Skip to step 4
If not linked, attempt to link by Git remote:
# Check if project is Git-based
git remote show origin
# If Git-based, extract remote URL
# Format: https://github.com/username/repo or [email protected]:username/repo.git
# Try to link by Git remote
npx netlify link --git-remote-url <REMOTE_URL>
If link fails (site doesn't exist on Netlify):
# Create new site interactively
npx netlify init
This guides user through:
Before deploying, ensure project dependencies are installed:
# For npm projects
npm install
# For other package managers, detect and use appropriate command
# yarn install, pnpm install, etc.
Choose deployment type based on context:
Preview/Draft Deploy (default for existing sites):
npx netlify deploy
This creates a deploy preview with a unique URL for testing.
Production Deploy (for new sites or explicit production deployments):
npx netlify deploy --prod
This deploys to the live production URL.
Deployment process:
After deployment, report to user:
netlify open to view site or dashboardIf a netlify.toml file exists, the CLI uses it automatically. If not, the CLI will prompt for:
npm run build, next builddist, build, .nextCommon framework defaults:
npm run build, publish .nextnpm run build, publish distThe skill should detect framework from package.json if possible and suggest appropriate settings.
# 1. Check authentication
npx netlify status
# If not authenticated:
npx netlify login
# 2. Link site (if needed)
# Try Git-based linking first
git remote show origin
npx netlify link --git-remote-url https://github.com/user/repo
# If no site exists, create new one:
npx netlify init
# 3. Install dependencies
npm install
# 4. Deploy (preview for testing)
npx netlify deploy
# 5. Deploy to production (when ready)
npx netlify deploy --prod
Common issues and solutions:
"Not logged in"
→ Run npx netlify login
"No site linked"
→ Run npx netlify link or npx netlify init
"Build failed" → Check build command and publish directory in netlify.toml or CLI prompts → Verify dependencies are installed → Review build logs for specific errors
"Publish directory not found" → Verify build command ran successfully → Check publish directory path is correct
Example guidance to the user:
The deploy needs escalated network access to deploy to Netlify. I can rerun the command with escalated permissions—want me to proceed?
For secrets and configuration:
process.env.VARIABLE_NAMEnetlify deploy (no --prod) first to test before productionnetlify open to view site in Netlify dashboardnetlify logs to view function logs (if using Netlify Functions)netlify dev for local development with Netlify Functionstools
Conduct comprehensive GDPR compliance assessments by evaluating data processing activities against EU Regulation 2016/679, including Article 30 records of processing, lawful basis validation, data subject rights implementation, Data Protection Impact Assessments (DPIAs) under Article 35, breach notification procedures, international transfer safeguards (SCCs, adequacy decisions), and technical/organizational measures under Article 32. Use when processing personal data of EU residents, preparing for supervisory authority audits, implementing privacy-by-design for new systems, scoping compliance gaps for M&A due diligence, assessing third-party processors, or responding to data subject access requests at scale. Incorporates 2026 guidance from ICO, EDPB, and post-Data (Use and Access) Act 2025 UK-GDPR considerations. Do not use for implementing specific Article 32 controls — use implementing-gdpr-data-protection-controls; or for DSAR automation — use implementing-gdpr-data-subject-access-request.
tools
Parse Windows forensic artifacts—$MFT/$J (MFTECmd), Prefetch (PECmd), registry hives (RECmd), shellbags, and Amcache—into normalized CSV/JSON with Eric Zimmerman's EZ Tools, then load results into Timeline Explorer for analysis. Use during DFIR/incident-response investigations, after triage collection (e.g. with KAPE), to establish program execution, file/folder access, and persistence evidence from acquired forensic images.
development
Build automated multi-turn adversarial attacks against conversational LLM targets using Microsoft PyRIT's RedTeamingOrchestrator, CrescendoOrchestrator (gradual escalation), and TreeOfAttacksWithPruningOrchestrator (adaptive branching), with scorer feedback loops and persisted conversation memory. Use when single-shot LLM scanning is insufficient and you need multi-turn, scorer-driven AI red-team campaigns against a chatbot or agent.
testing
Stand up MISP, enable and cache curated threat feeds (CIRCL, abuse.ch, Feodo Tracker), apply warninglists to suppress false positives, query indicators with PyMISP, and export attributes as auto-generated Suricata/Sigma/Wazuh detection rules. Use when maturing a MISP instance to actively drive detection, curating threat feeds with quality controls, or automating IOC-to-detection pipelines for the SIEM/IDS.