Borrowing it
Nothing to install: this file belongs to Portwood-Global-Solutions/Portwood. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/Portwood-Global-Solutions/Portwood/main/.claude/skills/managed-package-rules/SKILL.mdgit clone --depth 1 https://github.com/Portwood-Global-Solutions/PortwoodWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/portwood-global-solutions/portwood/managed-package-rules)<a href="https://agentmods.dev/skills/portwood-global-solutions/portwood/managed-package-rules"><img src="https://agentmods.dev/badge/skills/portwood-global-solutions/portwood/managed-package-rules/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/portwood-global-solutions/portwood/managed-package-rules"><img src="https://agentmods.dev/badge/skills/portwood-global-solutions/portwood/managed-package-rules.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00073 | $0.01073 |
| Opus 5 | $0.00036 | $0.00536 |
| Sonnet 5 | $0.00015 | $0.00215 |
| Haiku 4.5 | $0.00007 | $0.00107 |
Grade A, and why
managed-package-rules scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 95 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Managed-package constraints
Portwood ships as Managed 2GP, namespace portwoodglobal. A large class of bugs
exists only in a real subscriber install and cannot be reproduced in a no-namespace
scratch org. If something works in dev and fails in an install, start here.
Only global Apex is visible to subscribers
public classes and methods are invisible in a subscriber org.
- An
@InvocableMethodmust beglobalto appear in a subscriber's Flow Builder. - Helper classes a subscriber is meant to call must be
global, along with their inner types, fields and methods.
Flow Apex-Defined variable types — all four are required
For a type to be selectable as a Flow Apex-Defined variable in a subscriber org:
- Top-level / standalone class. Flow ignores inner and nested classes entirely.
globalclass.@AuraEnabledmembers.globalno-arg constructor.
Missing any one produces the same symptom: the action appears, but its variable type can't be selected. This cost three separate releases to get right, each time because only one of the four was missing. Verify in a real subscriber install or a namespaced scratch org — a no-namespace staging org cannot show you the failure.
API names are frozen forever
Everything shipped is immutable: DocGen_Template__c, DocGenService, DocGen_Admin,
the portwoodglobal namespace, the Canvas picklist value. Display names (labels,
descriptions, user-visible strings) can change; API names cannot.
Two scheduled job names deliberately keep their old strings because they're matched by
CronJobDetail.Name in orgs that already scheduled them: DocGen Signature Reminders
and DocGen Chart CV Reaper.
2GP also cannot drop Apex classes without the "Remove Metadata Components" DevHub feature — the workaround is inert stubs.
Namespace-prefixed keys break JS
In a subscriber org, SObject field keys come back namespace-prefixed:
row.Field__cisundefinedin a shipped package — it'srow.portwoodglobal__Field__c. Use@salesforce/schemaimports or a normalizing mapper in LWC.getPopulatedFieldsAsMap()keys are prefixed too. Prefer direct field access.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 95 lines · 73 tokens per session scan A f22cc863dcfe
managed-package-rules is a skill published in the GitHub repository Portwood-Global-Solutions/Portwood (122 stars, last pushed today), licensed Apache-2.0. It adds 73 tokens to every session and 1,073 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
docx_skill
Word document generation, supports headings/paragraphs/tables, generates professional format reports.
anthropics-office-skills
A local collection of documentation skills for Anthropic office tools, with instructions for cloning and installing only the needed files.
officecli
A command-line tool for reading, writing, and editing Word, Excel, and PowerPoint files without Microsoft Office installed. A command-line tool is controlled by typed commands or by software rather than by clicking through an app.
nebula-logger-install
Use this skill when the user wants to install and configure Nebula Logger in a Salesforce org for the first time. Covers package selection, installation paths, permissions, LoggerSettingsc hierarchy, and first-run troubleshooting.
nebula-logger-best-practices
Use this skill when the user wants to review, harden, or standardize Nebula Logger usage across a Salesforce team. Covers operational logging standards, environment-aware settings, limit-aware design, and governance guardrails.
hermesoffice-decks
Produce presentations in HermesOffice Slides — the plandeck/generatedeck pipeline, native element editing, and the templates/decks style specs (modern, elegant, professional, keynote-speaker, minimal, tech-dark, investor-pitch, workshop). Load for any request that creates or restyles a deck.