--- name: clay-policy-guardrails-63fdcf5fc25b description: | Implement Clay lint rules, policy enforcement, and automated guardrails. Use when setting up code quality rules for Clay integrations, implementing pre-commit hooks, or configuring CI policy checks for Clay best practices. Trigger with phrases like "clay policy", "clay lint", "clay guardrails", "clay best practices check", "clay eslint". allowed-tools: Read, Write, Edit, Bash(npx:*) version: 1.0.0 license: MIT author: Jeremy Longshore --- # Clay Policy & Guardrails ## Overview Automated policy enforcement and guardrails for Clay integrations. ## Prerequisites - ESLint configured in project - Pre-commit hooks infrastructure - CI/CD pipeline with policy checks - TypeScript for type enforcement ## ESLint Rules ### Custom Clay Plugin ```javascript // eslint-plugin-clay/rules/no-hardcoded-keys.js module.exports = { meta: { type: 'problem', docs: { description: 'Disallow hardcoded Clay API keys', }, fixable: 'code', }, create(context) { return { Literal(node) { if (typeof node.value === 'string') { if (node.value.match(/^sk_(live|test)_[a-zA-Z0-9]{24,}/)) { context.report({ node, message: 'Hardcoded Clay API key detected', }); } } }, }; }, }; ``` ### ESLint Configuration ```javascript // .eslintrc.js module.exports = { plugins: ['clay'], rules: { 'clay/no-hardcoded-keys': 'error', 'clay/require-error-handling': 'warn', 'clay/use-typed-client': 'warn', }, }; ``` ## Pre-Commit Hooks ```yaml # .pre-commit-config.yaml repos: - repo: local hooks: - id: clay-secrets-check name: Check for Clay secrets entry: bash -c 'git diff --cached --name-only | xargs grep -l "sk_live_" && exit 1 || exit 0' language: system pass_filenames: false - id: clay-config-validate name: Validate Clay configuration entry: node scripts/validate-clay-config.js language: node files: '\.clay\.json$' ``` ## TypeScript Strict Patterns ```typescript // Enforce typed configuration interface ClayStrictConfig { apiKey: string; // Required environment: 'development' | 'staging' | 'production'; // Enum timeout: number; // Required number, not optional retries: number; } // Disallow any in Clay code // @ts-expect-error - Using any is forbidden const client = new Client({ apiKey: any }); // Prefer this const client = new ClayClient(config satisfies ClayStrictConfig); ``` ## Architecture Decision Records ### ADR Template ```markdown # ADR-001: Clay Client Initialization ## Status Accepted ## Context We need to decide how to initialize the Clay client across our application. ## Decision We will use the singleton pattern with lazy initialization. ## Consequences - Pro: Single client instance, connection reuse - Pro: Easy to mock in tests - Con: Global state requires careful lifecycle management ## Enforcement - ESLint rule: clay/use-singleton-client - CI check: grep for "new ClayClient(" outside allowed files ``` ## Policy-as-Code (OPA) ```rego # clay-policy.rego package clay # Deny production API keys in non-production environments deny[msg] { input.environment != "production" startswith(input.apiKey, "sk_live_") msg := "Production API keys not allowed in non-production environment" } # Require minimum timeout deny[msg] { input.timeout < 10000 msg := sprintf("Timeout too low: %d < 10000ms minimum", [input.timeout]) } # Require retry configuration deny[msg] { not input.retries msg := "Retry configuration is required" } ``` ## CI Policy Checks ```yaml # .github/workflows/clay-policy.yml name: Clay Policy Check on: [push, pull_request] jobs: policy: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Check for hardcoded secrets run: | if grep -rE "sk_(live|test)_[a-zA-Z0-9]{24,}" --include="*.ts" --include="*.js" .; then echo "ERROR: Hardcoded Clay keys found" exit 1 fi - name: Validate configuration schema run: | npx ajv validate -s clay-config.schema.json -d config/clay/*.json - name: Run ESLint Clay rules run: npx eslint --plugin clay --rule 'clay/no-hardcoded-keys: error' src/ ``` ## Runtime Guardrails ```typescript // Prevent dangerous operations in production const BLOCKED_IN_PROD = ['deleteAll', 'resetData', 'migrateDown']; function guardClayOperation(operation: string): void { const isProd = process.env.NODE_ENV === 'production'; if (isProd && BLOCKED_IN_PROD.includes(operation)) { throw new Error(`Operation '${operation}' blocked in production`); } } // Rate limit protection function guardRateLimits(requestsInWindow: number): void { const limit = parseInt(process.env.CLAY_RATE_LIMIT || '100'); if (requestsInWindow > limit * 0.9) { console.warn('Approaching Clay rate limit'); } if (requestsInWindow >= limit) { throw new Error('Clay rate limit exceeded - request blocked'); } } ``` ## Instructions ### Step 1: Create ESLint Rules Implement custom lint rules for Clay patterns. ### Step 2: Configure Pre-Commit Hooks Set up hooks to catch issues before commit. ### Step 3: Add CI Policy Checks Implement policy-as-code in CI pipeline. ### Step 4: Enable Runtime Guardrails Add production safeguards for dangerous operations. ## Output - ESLint plugin with Clay rules - Pre-commit hooks blocking secrets - CI policy checks passing - Runtime guardrails active ## Error Handling | Issue | Cause | Solution | |-------|-------|----------| | ESLint rule not firing | Wrong config | Check plugin registration | | Pre-commit skipped | --no-verify | Enforce in CI | | Policy false positive | Regex too broad | Narrow pattern match | | Guardrail triggered | Actual issue | Fix or whitelist | ## Examples ### Quick ESLint Check ```bash npx eslint --plugin clay --rule 'clay/no-hardcoded-keys: error' src/ ``` ## Resources - [ESLint Plugin Development](https://eslint.org/docs/latest/extend/plugins) - [Pre-commit Framework](https://pre-commit.com/) - [Open Policy Agent](https://www.openpolicyagent.org/) ## Next Steps For architecture blueprints, see `clay-architecture-variants`. --- Source attribution: Dicklesworthstone Original project: https://github.com/Dicklesworthstone/pi_agent_rust/blob/f28fc46ee0db8e710d95b8b55592cd38d60f2b26/tests/ext_conformance/artifacts/plugins-community/plugins/saas-packs/clay-pack/skills/clay-policy-guardrails/SKILL.md License: MIT License information: https://opensource.org/license/mit Original upstream instructions; downloaded from Mega AI Hub. ## Upstream license notice MIT License (with OpenAI/Anthropic Rider) Copyright (c) 2026 Jeffrey Emanuel Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: ADDITIONAL RIDER / RESTRICTION (OpenAI / Anthropic): This rider is part of the "conditions" of this License. In the event of any conflict between this rider and any other portion of this License, this rider controls. "Restricted Parties" means OpenAI, L.L.C.; Anthropic, PBC; any of their respective Affiliates; and any person or entity acting directly or indirectly on behalf of, for the benefit of, or under the direction of any of the foregoing (including any officer, director, employee, contractor, agent, consultant, service provider, or representative). Notwithstanding any other provision of this License, no rights are granted to any Restricted Party. Any purported license, sublicense, assignment, transfer, or other permission to any Restricted Party is null and void absent the express prior written permission of Jeffrey Emanuel. You may not provide, disclose, distribute, sublicense, sell, lease, lend, host, make available, or otherwise permit access to the Software or any derivative work of the Software (as defined in applicable copyright law) (collectively, "Derivative Works") to or for any Restricted Party. For purposes of this rider, "use" includes, without limitation: copying, modifying, merging, publishing, distributing, sublicensing, selling, transferring, making available, hosting, deploying, executing, benchmarking, testing, analyzing, indexing, or incorporating the Software or any Derivative Works into any dataset, training corpus, evaluation harness, or pipeline for machine learning or other automated systems. This rider applies to the Software and all Derivative Works. As a condition of use, you agree that this rider is a precondition to exercising any rights under this License, and you agree that any distribution of the Software or any Derivative Works must include this rider provision unmodified. Any breach of this rider automatically and immediately terminates the permissions granted by this License. Upon termination, you must immediately cease all use and distribution of the Software and any Derivative Works and destroy all copies under your control. You agree that a breach of this rider would cause irreparable harm and that Jeffrey Emanuel may seek injunctive or other equitable relief to enforce this rider, in addition to any other remedies available at law. To the maximum extent permitted by applicable law, the prevailing party in any action to enforce this rider shall be entitled to recover reasonable attorneys' fees and costs. For purposes of this rider, "Affiliate" means any entity that directly or indirectly controls, is controlled by, or is under common control with the specified party. "Control" means ownership of more than 50% of the voting securities or other ownership interest, or the power to direct management or policies by contract or otherwise. The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. # Mega AI Hub resource metadata Creator / publisher: Dicklesworthstone Original project: https://github.com/Dicklesworthstone/pi_agent_rust/blob/f28fc46ee0db8e710d95b8b55592cd38d60f2b26/tests/ext_conformance/artifacts/plugins-community/plugins/saas-packs/clay-pack/skills/clay-policy-guardrails/SKILL.md Attribution basis: Source repository record Fields of work: Development & Engineering Roles: Backend Developer, Data Engineer, DevOps / SRE Specialties: Backend Tools: Clay Country applicability: Country not specified Classification basis: Source catalog labels Instruction SHA-256: 769d2de5d842b07854e398b904f3d321eb84a6fce0a8d1050ef39d1dddff83cb