Update to Preset API Skills

{
  "description": "Review embedded analytics row-level security clauses, tenant filters, guest-token RLS rules, and external-viewer isolation for direct API workflows. Use only for direct API workflows; Do not use for MCP-only work.",
  "included_files": [
    {
      "relative_path": "references/embedded-rls-rules.md",
      "size_in_bytes": 1330
    }
  ],
  "name": "preset-embedded-rls",
  "skill_md_contents": "---\nname: preset-embedded-rls\ndescription: Review embedded analytics row-level security clauses, tenant filters, guest-token RLS rules, and external-viewer isolation for direct API workflows. Use only for direct API workflows; Do not use for MCP-only work.\n---\n\n# preset-embedded-rls\n\nUse before guest-token creation when embedded viewers need row-level security.\n\n## Always\n\n- Auth and conventions come from `preset-api` (JWT exchange, base URLs, Rison); resolve the workspace hostname through the Management API when it is not already known. Consult metadata skills only when column validation is required.\n- Do not invent tenant identifiers, filters, dataset columns, or access rules.\n- Treat RLS clauses as permission controls that can leak or hide customer data.\n- Confirm every clause and intended viewer population before token creation.\n- Do not validate with broad data-returning queries unless the user approves target and limit.\n\n## Decision Rules\n\n- Classify embedded RLS review as plan-only safety work.\n- Identify tenant and user filter safety issues.\n- Require approval before clauses are used in token claims.\n- Avoid mutating embedded RLS configuration.\n\n## Workflow Order\n\n1. Inspect embedded RLS clauses.\n2. Flag unsafe tenant and user filters.\n3. Summarize approval requirements.\n4. Stop before using clauses in tokens.\n\n## Retrieve\n\n- Embedded RLS rule design and review: [references/embedded-rls-rules.md](references/embedded-rls-rules.md)\n"
}