cm-identity-guard

Name: cm-identity-guard
Author: tody-agent

47stars23forks

How to install cm-identity-guard?

tody-agent/codymaster/cm-identity-guard

$npx -y skills add tody-agent/codymaster --skill cm-identity-guard

Installs into the current project.

Summary

Verify and lock project identity before ANY git push, Cloudflare deploy, or Supabase operation. Essential when working with multiple GitHub accounts (personal + work), multiple Cloudflare accounts, or multiple Supabase/Neon projects. Prevents wrong-account deploys, cross-project

Files · 1

View on GitHub

SKILL.md

1	# Identity Guard — Multi-Account Safety Protocol
2
3	## TL;DR
4	- Use before any git push, Cloudflare deploy, or Supabase op
5	- Verifies: GitHub account, CF account, Supabase project match expected
6	- Prevents: wrong-account deploys, cross-project secret leaks
7
8	## Overview
9
10	Working across multiple projects, clients, and platforms means one wrong `git push` or `wrangler deploy` can publish work to the wrong account. This skill establishes a mandatory identity check before any operation that touches external services.
11
12	> [!CAUTION]
13	> Real incidents this skill prevents:
14	> - Pushed client code to personal GitHub repo
15	> - Deployed to wrong Cloudflare account (different org's Pages project, billing confusion)
16	> - Used personal Supabase `ANON_KEY` in a client project (wrong DB entirely)
17	> - `git config user.email` was personal email → commits show wrong author in client repo
18
19	## The Iron Law
20
21	```
22	NEVER push, deploy, or use secrets WITHOUT verifying identity first.
23	ASK: Which account? Which project? Which database?
24	ONE command verifies all three. Run it. Always.
25	```
26
27	## When to Use
28
29	ALWAYS before:
30	- `git push` or `git commit` in a project with multiple account contexts
31	- `wrangler pages deploy` or any Cloudflare operation
32	- Creating or accessing a Supabase/Neon client
33	- Setting up a new project from scratch
34	- Resuming work after switching between personal and work projects
35
36	---
37
38	## Account Registry (Your Known Accounts)
39
40	Maintain this table in your head (or in `.project-identity.json`):
41
42	### GitHub Accounts
43
44	\| Account \| Purpose \| Email \| When to Use \|
45	\|---------\|---------\|-------\|-------------\|
46	\| `my-personal` \| Personal projects, experiments \| personal email \| Personal repos, side projects \|
47	\| `my-work-org` \| Client work \| `dev@workdomain.com` \| All client projects \|
48
49	### Cloudflare Accounts
50
51	\| Account ID \| Purpose \| Projects \|
52	\|-----------\|---------\|---------\|
53	\| `abc123def456ghi789jkl012mno345pqr` \| Client A / Org \| project-1, project-2, app \|
54	\| (personal) \| Personal experiments \| personal side projects \|
55
56	### Database Accounts
57
58	\| Service \| Account \| Purpose \|
59	\|---------\|---------\|---------\|
60	\| Supabase (Org) \| org account \| All Client A apps \|
61	\| Supabase (personal) \| personal account \| Experiments \|
62	\| Neon \| per project \| If used \|
63
64	---
65
66	## Phase 0: Project Identity File
67
68	Every project MUST have a `.project-identity.json` in the project root:
69
70	```json
71	{
72	"name": "my-awesome-project",
73	"description": "An awesome internal tool",
74	"github": {
75	"account": "my-work-org",
76	"org": "my-work-org",
77	"repo": "my_project_repo",
78	"remoteUrl": "https://github.com/my-work-org/my_project_repo.git",
79	"userEmail": "dev@workdomain.com"
80	},
81	"cloudflare": {
82	"accountId": "abc123def456ghi789jkl012mno345pqr",
83	"projectName": "my-frontend-app",
84	"stagingUrl": "https://my-app-staging.pages.dev",
85	"productionUrl": "https://myapp.workdomain.com",
86	"productionBranch": "production"
87	},
88	"database": {
89	"provider": "supabase",
90	"projectName": "my-database-project",
91	"urlVar": "SUPABASE_URL",
92	"anonKeyVar": "SUPABASE_ANON_KEY",
93	"serviceKeyVar": "SUPABASE_SERVICE_KEY",
94	"secretsStore": "cloudflare-secrets"
95	},
96	"i18n": {
97	"primary": "vi",
98	"languages": ["vi", "en", "th", "ph"],
99	"dir": "public/static/i18n"
100	}
101	}
102	```
103
104	> [!IMPORTANT]
105	> Add `.project-identity.json` to git but NEVER put actual secrets in it — only variable NAMES and account IDs. Secrets live in `.dev.vars` (local) or Cloudflare Secrets (production).
106
107	---
108
109	## Phase 1: Identity Verification
110
111	### The One-Liner Check
112
113	Run this before any push or deploy:
114
115	```bash
116	# Full identity check — GitHub + Git user + CF account + DB config
117	echo "=== GitHub CLI ===" && gh auth status 2>&1 \| grep -E "Logged in\|github.com" && \
118	echo "=== Git Remote ===" && git remote get-url origin && \
119	echo "=== Git User ===" && git config user.name && git config user.email && \
120	echo "=== Cloudflare ===" && cat wrangler.jsonc \| grep -E "account_id\|project\|name" \| head -5 && \
121	echo "=== DB Config ===" && cat .dev.vars 2>/dev/null \| grep -E "URL\|SUPABASE" \| sed 's/=./=**/' && \
122	echo "=== Expected ===" && cat .project-identity.json 2>/dev/null \| python3 -c "import sys,json; d=json.load(sys.stdin); print('GitHub:', d['github']['account'], '\| CF:', d['cloudflare']['accountId'][:8]+'...', '\| DB:', d['database']['provider'])"
123	```
124
125	### What to Verify (Checklist)
126
127	```
128	☐ GitHub CLI: logged in as <EXPECTED ACCOUNT>
129	☐ git remote origin: points to <EXPECTED REPO URL>
130	☐ git config user.email: matches <EXPECTED EMAIL>
131	☐ wrangler.jsonc

People who liked this also viewed

6 picks

Type

cm-identity-guard

47stars23forks

View on GitHub

How to install cm-identity-guard?

tody-agent/codymaster/cm-identity-guard

$npx -y skills add tody-agent/codymaster --skill cm-identity-guard

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Identity Guard — Multi-Account Safety Protocol
2
3	## TL;DR
4	- Use before any git push, Cloudflare deploy, or Supabase op
5	- Verifies: GitHub account, CF account, Supabase project match expected
6	- Prevents: wrong-account deploys, cross-project secret leaks
7
8	## Overview
9
10	Working across multiple projects, clients, and platforms means one wrong `git push` or `wrangler deploy` can publish work to the wrong account. This skill establishes a mandatory identity check before any operation that touches external services.
11
12	> [!CAUTION]
13	> Real incidents this skill prevents:
14	> - Pushed client code to personal GitHub repo
15	> - Deployed to wrong Cloudflare account (different org's Pages project, billing confusion)
16	> - Used personal Supabase `ANON_KEY` in a client project (wrong DB entirely)
17	> - `git config user.email` was personal email → commits show wrong author in client repo
18
19	## The Iron Law
20
21	```
22	NEVER push, deploy, or use secrets WITHOUT verifying identity first.
23	ASK: Which account? Which project? Which database?
24	ONE command verifies all three. Run it. Always.
25	```
26
27	## When to Use
28
29	ALWAYS before:
30	- `git push` or `git commit` in a project with multiple account contexts
31	- `wrangler pages deploy` or any Cloudflare operation
32	- Creating or accessing a Supabase/Neon client
33	- Setting up a new project from scratch
34	- Resuming work after switching between personal and work projects
35
36	---
37
38	## Account Registry (Your Known Accounts)
39
40	Maintain this table in your head (or in `.project-identity.json`):
41
42	### GitHub Accounts
43
44	\| Account \| Purpose \| Email \| When to Use \|
45	\|---------\|---------\|-------\|-------------\|
46	\| `my-personal` \| Personal projects, experiments \| personal email \| Personal repos, side projects \|
47	\| `my-work-org` \| Client work \| `dev@workdomain.com` \| All client projects \|
48
49	### Cloudflare Accounts
50
51	\| Account ID \| Purpose \| Projects \|
52	\|-----------\|---------\|---------\|
53	\| `abc123def456ghi789jkl012mno345pqr` \| Client A / Org \| project-1, project-2, app \|
54	\| (personal) \| Personal experiments \| personal side projects \|
55
56	### Database Accounts
57
58	\| Service \| Account \| Purpose \|
59	\|---------\|---------\|---------\|
60	\| Supabase (Org) \| org account \| All Client A apps \|
61	\| Supabase (personal) \| personal account \| Experiments \|
62	\| Neon \| per project \| If used \|
63
64	---
65
66	## Phase 0: Project Identity File
67
68	Every project MUST have a `.project-identity.json` in the project root:
69
70	```json
71	{
72	"name": "my-awesome-project",
73	"description": "An awesome internal tool",
74	"github": {
75	"account": "my-work-org",
76	"org": "my-work-org",
77	"repo": "my_project_repo",
78	"remoteUrl": "https://github.com/my-work-org/my_project_repo.git",
79	"userEmail": "dev@workdomain.com"
80	},
81	"cloudflare": {
82	"accountId": "abc123def456ghi789jkl012mno345pqr",
83	"projectName": "my-frontend-app",
84	"stagingUrl": "https://my-app-staging.pages.dev",
85	"productionUrl": "https://myapp.workdomain.com",
86	"productionBranch": "production"
87	},
88	"database": {
89	"provider": "supabase",
90	"projectName": "my-database-project",
91	"urlVar": "SUPABASE_URL",
92	"anonKeyVar": "SUPABASE_ANON_KEY",
93	"serviceKeyVar": "SUPABASE_SERVICE_KEY",
94	"secretsStore": "cloudflare-secrets"
95	},
96	"i18n": {
97	"primary": "vi",
98	"languages": ["vi", "en", "th", "ph"],
99	"dir": "public/static/i18n"
100	}
101	}
102	```
103
104	> [!IMPORTANT]
105	> Add `.project-identity.json` to git but NEVER put actual secrets in it — only variable NAMES and account IDs. Secrets live in `.dev.vars` (local) or Cloudflare Secrets (production).
106
107	---
108
109	## Phase 1: Identity Verification
110
111	### The One-Liner Check
112
113	Run this before any push or deploy:
114
115	```bash
116	# Full identity check — GitHub + Git user + CF account + DB config
117	echo "=== GitHub CLI ===" && gh auth status 2>&1 \| grep -E "Logged in\|github.com" && \
118	echo "=== Git Remote ===" && git remote get-url origin && \
119	echo "=== Git User ===" && git config user.name && git config user.email && \
120	echo "=== Cloudflare ===" && cat wrangler.jsonc \| grep -E "account_id\|project\|name" \| head -5 && \
121	echo "=== DB Config ===" && cat .dev.vars 2>/dev/null \| grep -E "URL\|SUPABASE" \| sed 's/=./=**/' && \
122	echo "=== Expected ===" && cat .project-identity.json 2>/dev/null \| python3 -c "import sys,json; d=json.load(sys.stdin); print('GitHub:', d['github']['account'], '\| CF:', d['cloudflare']['accountId'][:8]+'...', '\| DB:', d['database']['provider'])"
123	```
124
125	### What to Verify (Checklist)
126
127	```
128	☐ GitHub CLI: logged in as <EXPECTED ACCOUNT>
129	☐ git remote origin: points to <EXPECTED REPO URL>
130	☐ git config user.email: matches <EXPECTED EMAIL>
131	☐ wrangler.jsonc

People who liked this also viewed

6 picks

Type