Skip to main content
affpapa.org
RU EN
skill CX Codex

vtex-io-auth-and-policies — Claude Code skill

This skill guides VTEX IO permission design for integrations, protected routes, and manifest policies. Use it when access boundaries need review or change.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add vtex/skills --skill vtex-io-auth-and-policies -a claude-code
Open on GitHub

What vtex-io-auth-and-policies does

The skill helps map VTEX IO app capabilities to explicit authorization rules. It covers access to VTEX resources, services exposed by other apps, and external HTTP endpoints. It also separates consumer permissions from server-side protection for routes owned by the app.

Its main focus is manifest.json, including License Manager entries, app policies, and outbound-access. External rules should name the required host and path, while protected routes can use resource-based policies. VRNs belong where the platform expects resource or principal identifiers, such as service.json policies.

A missing required policy causes the platform to block the request even when the handler code is correct. Review the permission boundary whenever a new client, external host, integration, or protected route appears, and narrow wildcard access where the integration uses a smaller surface.

What it helps with

  • audit VTEX IO app permissions
  • declare access for an external API
  • map a route to an authorization policy
  • narrow an outbound-access rule
  • spot missing entries in manifest.json

Example prompts for the agent

  • Review this VTEX IO app and list the permissions missing from manifest.json.
  • Add access for the external API and keep its outbound-access host and path narrow.
  • Check which callers may reach this protected route and align it with a resource-based policy.

How to install vtex-io-auth-and-policies

1Skills CLI (Vercel)

npx skills add vtex/skills --skill vtex-io-auth-and-policies -a claude-code

2Manually: put the files in place

~/.claude/skills/vtex-io-auth-and-policies/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/vtex-io-auth-and-policies/

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about vtex-io-auth-and-policies

How do I install vtex-io-auth-and-policies in Claude Code?

Run npx skills add vtex/skills --skill vtex-io-auth-and-policies -a claude-code, then check ~/.claude/skills/vtex-io-auth-and-policies/SKILL.md.

What does vtex-io-auth-and-policies do?

It guides policy choices for VTEX resources, app-to-app access, and external HTTP services. It also reviews server-side protection for restricted routes.

What should an outbound-access policy contain?

It should target the required host and path rather than a wider wildcard. Access controlled by License Manager or another app’s policy belongs in the matching manifest.json declaration.

Similar skills

All skills for Security →
git-guardrails-claude-code Matt Pocock This skill adds a Claude Code hook that stops risky Git commands before they run. Use it when an agent must not push or discard working-tree changes. 499,069installs ponytail-review DietrichGebert ponytail-review reviews a change beyond the diff, checking connected code, bugs, risks, load, tests, speed, and unnecessary code. Use it for PRs and commits. CX Codex +1 57,000installs ponytail-audit DietrichGebert It audits a repository and ranks bugs, risks, and redundant code in a one-shot report. Use it when you need a review without code changes. CX Codex +1 45,400installs security-audit cloudflare Reviews codebases and APIs for vulnerabilities using safe sandboxing. Fits pre-release security reviews, pen-test triage, and architecture checks. CX Codex +1 54,800installs security-and-hardening addyosmani Guides threat modeling and security checks for code that handles user input, authentication, sessions, or external services. Use it when building a feature that accepts untrusted data or reviewing code before release. CX Codex +1 70,200installs supabase official supabase Guides the agent through database configuration and strict RLS policies in Supabase. CX Codex GP ChatGPT 8installs

From the same set38

vtex-io-data-access-patterns Guides AI coding agents on picking the right storage layer across VTEX IO apps. It helps design read pipelines, caching strategies, and data boundaries. CX Codex +1 1,100installs vtex-io-auth-tokens-and-context Decides which VTEX IO token should back a backend request: the app itself, a shopper, or an Admin user. CX Codex +1 1,100installs vtex-io-render-runtime-and-blocks Teaches the agent to expose React components as Store Framework blocks in VTEX IO: store/interfaces.json entries, composition and theme wiring. CX Codex +1 1,100installs vtex-io-client-integration Guides backend integrations in VTEX IO apps using @vtex/api and @vtex/clients. Helps select client classes, configure runtime options, and replace raw HTTP calls. CX Codex +1 1,100installs vtex-io-admin-react Guides coding agents in building VTEX IO admin pages with React, enforcing official design systems, bounded tables, and predictable feedback states. CX Codex +1 1,100installs vtex-io-http-routes Guides the design of HTTP endpoints in a VTEX IO backend service: route boundaries, middleware chains, request validation and response shape. CX Codex +1 1,100installs marketplace-fulfillment Helps an agent build the seller side of VTEX fulfillment: simulation, order reservations, dispatch, and invoice and tracking calls to OMS. CX Codex +1 1,000installs marketplace-order-hook Guides VTEX order integrations built with Feed v3 or Hook. Use it when a webhook must validate events, fetch order data, and avoid duplicate processing. CX Codex +1 1,000installs

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor