Skip to main content
affpapa.org
RU EN
skill CX Codex

vtex-io-security-boundaries — Claude Code skill: setup & use

Guides coding assistants when auditing route exposure and data boundaries in VTEX IO apps. Prevents tenant leaks and enforces payload validation.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add vtex/skills --skill vtex-io-security-boundaries -a claude-code
Open on GitHub

What vtex-io-security-boundaries does

This skill guides assistants through inspecting service exposure in VTEX IO backends. It treats any route marked with public: true in service.json as exposed to the open web. Obscure route paths offer zero protection. Handlers must inspect incoming bodies, query parameters, and secret headers before passing payloads to internal handlers.

The instructions establish explicit development rules. Services must filter outgoing responses so upstream records never return raw payloads to callers. Logic handling tenant data must verify ctx.vtex.workspace and ctx.vtex.account to avoid cross-tenant contamination. Standard runtime console.log calls are banned in favor of structured logging via ctx.vtex.logger.

Permissions inside manifest.json and identity token selection stay out of scope. Those checks belong in companion VTEX skills.

What it helps with

  • validate incoming webhook payloads before executing domain methods
  • isolate data across tenant accounts and isolated workspaces
  • trim raw downstream payloads to stop internal field leaks
  • replace unformatted console.log statements with ctx.vtex.logger

Example prompts for the agent

  • Review our service.json routes to make sure no internal endpoints are public
  • Add early payload and signature validation to this incoming webhook handler
  • Strip sensitive fields from this response object before returning it to the caller

How to install vtex-io-security-boundaries

1Skills CLI (Vercel)

npx skills add vtex/skills --skill vtex-io-security-boundaries -a claude-code

2Manually: put the files in place

~/.claude/skills/vtex-io-security-boundaries/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/vtex-io-security-boundaries/

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about vtex-io-security-boundaries

How to install vtex-io-security-boundaries in Claude Code?

Run npx skills add vtex/skills --skill vtex-io-security-boundaries -a claude-code. The file will be written to ~/.claude/skills/vtex-io-security-boundaries/SKILL.md.

What does vtex-io-security-boundaries do?

It provides rules for securing VTEX IO service routes, catching accidental data exposure, and enforcing boundary input checks.

How does this differ from vtex-io-auth-and-policies?

This skill evaluates what data safely crosses app boundaries, whereas vtex-io-auth-and-policies configures permission policies in manifest.json.

Similar skills

All skills for Security →
git-guardrails-claude-code Matt Pocock This skill adds a Claude Code hook that stops risky Git commands before they run. Use it when an agent must not push or discard working-tree changes. 499,069installs ponytail-review DietrichGebert ponytail-review reviews a change beyond the diff, checking connected code, bugs, risks, load, tests, speed, and unnecessary code. Use it for PRs and commits. CX Codex +1 57,000installs ponytail-audit DietrichGebert It audits a repository and ranks bugs, risks, and redundant code in a one-shot report. Use it when you need a review without code changes. CX Codex +1 45,400installs security-audit cloudflare Reviews codebases and APIs for vulnerabilities using safe sandboxing. Fits pre-release security reviews, pen-test triage, and architecture checks. CX Codex +1 54,800installs security-and-hardening addyosmani Guides threat modeling and security checks for code that handles user input, authentication, sessions, or external services. Use it when building a feature that accepts untrusted data or reviewing code before release. CX Codex +1 70,200installs supabase official supabase Guides the agent through database configuration and strict RLS policies in Supabase. CX Codex GP ChatGPT 8installs

From the same set38

vtex-io-observability-and-ops Adds structured logs and client metrics to VTEX IO backend services, so production failures are easy to trace before and after a release. CX Codex +1 1,100installs faststore-storefront Guides AI coding agents through VTEX FastStore storefront development: React 18 components, section overrides, SCSS styling constraints, and CMS schema sync. CX Codex +1 1,100installs vtex-io-service-paths-and-cdn Picks the right path prefix in service.json and matches Cache-Control to the data, so edge caching does not serve one shopper's payload to another. CX Codex +1 1,100installs vtex-io-messages-and-i18n Keeps user-facing copy in the VTEX IO messages infrastructure instead of hardcoded strings in JSX and resolvers. CX Codex +1 1,100installs vtex-io-events-and-workers Guides the agent in writing VTEX IO event handlers and workers that survive duplicate delivery. Useful when slow work should leave your HTTP routes. CX Codex +1 1,100installs vtex-io-service-configuration-apps Guides the agent through building VTEX IO configuration apps using the configuration builder. Helps inject decoupled workspace settings into service runtimes. CX Codex +1 1,100installs vtex-io-app-contract Checks the VTEX IO app contract in manifest.json, including builders and dependency links. Use it when creating, splitting, or publishing apps. CX Codex +1 1,100installs vtex-io-service-runtime Guides the runtime layout of a VTEX IO backend app: the Service entrypoint, typed context, and service.json execution settings. CX Codex +1 1,100installs

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor