Contentstack Vibe Docs

The skills CLI auto-detects the agents you have installed and wires up vibe docs for all of them. No per-tool config, no manual file copying.

For any Agent

npx skills add contentstack/contentstack-vibe-docs

Already installed? Check for updates with

npx skills check
npx skills update

If you'd rather install for one specific agent, or your tool has its own native install path, pick yours below.

Claude Code

claude skill add contentstack/contentstack-vibe-docs

Cursor

npx skills add contentstack/contentstack-vibe-docs -a cursor
GitHub Copilot

Find more ways to install.

Agents are eager to be helpful, which is exactly the problem. Without guardrails they'll happily hardcode an API key into a file or paste a Management Token into a frontend component. Vibe docs rewires that instinct.

• Environment variables only. The agent is instructed to write process.env.CONTENTSTACK_API_KEY, never the literal value, never a placeholder it might forget to swap out later.
• Token paste detection. If you accidentally paste a real token into the chat, the agent flags it, suggests rotation, and refuses to use it inline.
• Server-side enforcement. Management Tokens are flagged as server-side only. The agent will refuse to put them in client-side code, even if you ask.
• .env stays local. The agent is instructed never to commit .env files or write them into examples that might be copied into a repo.

Most security failures aren't dramatic, they're someone using the wrong token type, hitting the wrong endpoint, or mixing SDK patterns in a way that quietly leaks data. Vibe docs catches the boring stuff before it ships.

• Red Flags checklist. A dedicated section in the skill lists specific anti-patterns the agent must refuse, from hardcoding secrets to mixing Delivery and Management SDK patterns incorrectly.
• Questions before code. The agent is guided to ask about region, environment, and token type before writing anything. The right pattern depends on the answer, and getting it wrong is expensive to undo.
• Token type guidance. Delivery, Preview, Management, Authtoken, OAuth: the skill knows when each is appropriate and which one to refuse outright for the task at hand.
• Region awareness. Wrong-region credentials silently fail or hit the wrong data. The skill checks for region context and writes code that works on the stack you're actually using.