backstage-scaffolder-template-review

Use this skill when reviewing Backstage Scaffolder software templates. Trigger when the user asks whether a template is safe for developer self-service, whether template RBAC gates are in place, whether input parameters are validated, whether a step action has excessive blast radius, or whether template outputs expose secrets.

Jump to install

Repository: Raishin/vanguard-frontier-agentic
Last source activity: May 5, 2026 at 17:49
Detected SKILL.md language: English
Stars: 18
Forks: 3

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

A direct command skips the review prompt. Inspect the source before running it.

npx skills add https://github.com/Raishin/vanguard-frontier-agentic --skill backstage-scaffolder-template-review

The command stays on one line. Scroll horizontally to inspect it before copying.

Prefer a local copy? Download the files currently available to SkillsMP.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

File Explorer

3 files

SKILL.md

Source instructions · Read-only preview

Back to search Back to installation

kotlin-android-architecture

Use this skill to statically review Android app architecture correctness: ViewModel lifecycle and scoping across configuration changes, SavedStateHandle persistence across process death, lifecycle-aware Flow collection (repeatOnLifecycle/collectAsStateWithLifecycle/flowWithLifecycle), and unidirectional data flow with a single source of truth. Reads source only; it never runs or instruments the app.

2026-07-21

kotlin-android-security-privacy

Use this skill to statically review an Android app's security and privacy posture against OWASP MASVS: exported components and intent surfaces, deep-link/App Links validation, WebView exposure, cleartext traffic and network-security-config, local storage and secrets (EncryptedSharedPreferences/Keystore), backup exposure, runtime-permission minimization, and PII in logs. Reads manifest, source, and sanitized config only; it never builds, installs, or instruments an app.

2026-07-21

kotlin-library-api-abi-governance

Use this skill to statically review Kotlin library public-API evolution and binary/source compatibility for libraries consumed by both Kotlin and Java: binary-compatibility-validator .api snapshots and apiCheck gating, Explicit API mode, @JvmOverloads/@JvmStatic/@JvmName Java-facing surface shaping, and ABI-sensitive data-class and inline-function-body changes. Reads source and build configuration only; it never runs apiDump/apiCheck or publishes a release.

2026-07-21

View all from this repository

Backstage Scaffolder Template Review

Purpose

Review Backstage Scaffolder Template kind resources for action blast-radius, input parameter injection risk, RBAC permission gate coverage, integration secret scope, catalog entity poisoning via catalog:register, and plaintext secret exposure in output: stanzas. Backstage Scaffolder gives developers a curated UI to trigger powerful backend actions — without RBAC gates and input validation, every authenticated developer effectively has write access to whatever the Scaffolder integration credentials can reach.

Lean operating rules

Prefer user-provided sanitized Template YAML as primary evidence; official Backstage docs are the authoritative fallback.

Treat any steps: action that provisions real cloud infrastructure (Terraform, Crossplane CRD apply, CloudFormation deploy, kubectl apply) with no RBAC permission gate as a CRITICAL finding.

Treat input parameters flowing unsanitized into publish:github.repoUrl, file-path actions, or shell-exec actions as a HIGH finding — path traversal and injection are realistic.

Treat publish:github with visibility: public as the default or without an allowedHosts constraint as a HIGH finding.

Treat output: stanzas exposing plaintext generated credentials, connection strings, or API keys in the Backstage UI as a HIGH finding.

Treat the absence of @backstage/plugin-permission-backend policies for infrastructure-provisioning templates as a HIGH finding — any authenticated Backstage user can trigger them.

Treat catalog:register accepting arbitrary user-supplied YAML without server-side entity schema validation as a MEDIUM finding — catalog poisoning overwrites ownership and lifecycle metadata.

Keep the answer scoped: report what was reviewed, the evidence level, and exactly which steps or fields triggered each finding.

References

Load these only when needed:

Response minimum

Scoped target (Template metadata.name) and evidence level

Each steps: action type and its provisioning blast radius

Input parameter validation gaps (missing maxLength, pattern, enum)

RBAC permission gate verdict (present / absent / partial)

Integration secret scope assessment

output: stanza exposure assessment

Safe next actions and open questions