Factory Security
nonlinear-xyz/factory-kitSecurity conventions for builds that touch sensitive data, regulated industries, or AI-generated code paths. Covers KMS encryption at rest, BAA verification for PHI in email/SMS, safe URL redirects, admin-client bypass guardrails, in-memory rate-limiter caveats, the "read-only by default" stance for AI-generated code, mandatory-review-queue pattern, and request tracing for support workflows.
At a glance
This skill is for Legal and helps you verify compliance with healthcare data regulations, secure builds handling sensitive data, and implement encryption for regulated systems.
/plugin marketplace add nonlinear-xyz/factory-kit
/plugin install factory-security
Setup, runtime and requirements describe nonlinear-xyz/factory-kit, the repo this skill ships in.
HipaaKmsBaaencryptionPhfai-generated-code
Also in nonlinear-xyz/factory-kit
View the repoMotion discipline distilled across builds. Attention as a fixed per-viewport budget, figure/ground separation (calm the ground, load motion...
API conventions for both server actions and tRPC builds. Covers the decision between them, per-mutation Zod input schemas, central router co...
Use when designing or implementing API endpoints — server actions, tRPC procedures, REST routes for external consumers. Carries the factory'...
Auth and authorization conventions distilled across builds with three different auth stacks (Better Auth + orgs, Supabase Auth + RLS, Clerk)...
Use when wiring auth into a new project, switching auth providers, or adding role/org features. Carries the factory's auth conventions — the...
CI and pull-request review conventions. One canonical `.github/workflows/ci.yml` is the merge gate (typecheck, lint, test, build, claude-rev...
Close out a Linear issue — move to Done, add a closing comment, and clean up the local branch/worktree
Use to review a PR, diff, or recently-written code against the factory's conventions. Read-only — outputs structured review, not diffs. Carr...
Commit message and branch convention — Conventional Commits format with a Linear issue reference required in subject or body. Includes the c...
Database schema, ORM, and migration conventions across builds. Drizzle as default with domain-partitioned schema modules, shared `timestamps...
Use when designing or implementing data ingestion, CSV imports, time-series storage, Python services that sit alongside Next.js, simulation...
Data ingestion and pipeline conventions for projects that import CSVs, run simulations, or operate Python services alongside Next.js. Covers...
Other Legal skills
Applies Anthropic's official brand colors and typography to any sort of artifact that may benefit from having Anthropic's look-and-feel. Use...
Review the changes since a fixed point (commit, branch, tag, or merge-base) along two axes — Standards (does the code follow this repo's doc...
Meeting notes page — title bar with attendees, agenda checklist, decisions block, action items table with owners + dates, and a "next meetin...
An editorial-style poster — newsprint paper, dateline, oversized serif headline with a struck-through word and italic accent, a 2-column bod...
A standalone pricing page — header, plan tiers, feature comparison table, and an FAQ. Use when the brief asks for "pricing", "plans", "subsc...
Apple Human Interface Guidelines as 14 agent skills covering platforms, foundations, components, patterns, inputs, and technologies for iOS,...