{"id":48417,"plugin_id":"plugins_6ac7198c35d48191857f44d58398daf7","kind":"skill","collection_source":"plugin_package","comparison_source":null,"observed_at":"2026-10-24T13:36:24.710Z","digest":"082d75de4f0ce8be00f0ebd431af2d5952666bcbde5936ffe6573ddbcf4d0068","against":null,"payload":{"description":"Prepare and create Preset embedded dashboard guest tokens, external-user claims, resource claims, RLS claims, and token-handling plans through direct Superset API calls. Use only for direct API workflows; Do not use for MCP-only work.","included_files":[{"relative_path":"examples/guest_token_claims.py","size_in_bytes":616},{"relative_path":"references/guest-token-claims.md","size_in_bytes":1526}],"name":"preset-guest-tokens","skill_md_contents":"---\nname: preset-guest-tokens\ndescription: Prepare and create Preset embedded dashboard guest tokens, external-user claims, resource claims, RLS claims, and token-handling plans through direct Superset API calls. Use only for direct API workflows; Do not use for MCP-only work.\n---\n\n# preset-guest-tokens\n\nUse for security-sensitive guest-token payload review and creation.\n\n## Always\n\n- Auth and conventions come from `preset-api` (JWT exchange, base URLs, Rison); resolve the workspace hostname through the Management API when it is not already known. Consult `preset-embedding` for embedded-config context when it is missing.\n- Use `preset-embedded-rls` when row-level security clauses are present.\n- Require explicit confirmation before `POST /api/v1/security/guest_token/`.\n- Confirm dashboard/resource UUID, user claims, RLS clauses, token handling, and expiration expectations.\n- Do not invent RLS clauses, trusted domains, or authorization details; ask for missing authorization details.\n- Never print signed guest tokens in logs, examples, PR comments, or handoff notes.\n\n## Decision Rules\n\n- Classify guest token creation as token issuance.\n- Require approval summary with dashboard, resource, user, RLS, audience, expiration, and handling.\n- Never create or print a signed token before approval.\n- Separate embedded config reads from token creation.\n\n## Workflow Order\n\n1. Inspect dashboard and embedded config metadata.\n2. Summarize token claims, resources, user payload, RLS, audience, and handling.\n3. Request explicit approval.\n4. Stop before creating or printing token.\n\n## Retrieve\n\n- Guest-token claims, resources, user payload, RLS, token handling: [references/guest-token-claims.md](references/guest-token-claims.md)\n- Approval policy: load `preset-api` and then `references/safety-policy.md`.\n"},"changes":[],"summary":"First saved snapshot. No earlier version is available for comparison.","summary_kind":"deterministic","summary_metadata":{}}