[Mun-GitHub]

Summary

Adds an advisory, read-only asset-management skill for the standalone Contentstack Assets (DAM) product. It is distinct from cms-assets, which covers the CMS stack asset library. Each skill now routes to the other where the scope differs.

Covers: spaces and workspaces, folders, roles, asset types and metadata (user-defined fields: single line text, number, select, group), filters and saved views, localization, searching and filtering by user-defined fields via the Assets API search endpoint, AI tags and alt text, duplicate management, versions, trash and restore, visual markups, and CMS integration.

Changes

• New skill: skills/asset-management/SKILL.md
• New docs page docs/skills/asset-management.md, linked from docs/skills/index.md
• Added to README.md, docs/README.md, docs/overview/introduction.md and docs/how-it-works/router.md (24 skills, 7 products)
• cms-assets (skill and docs page): scoped to the stack asset library. DAM questions and user-defined field read/update requests now route to asset-management.
• Merged main: the generated cursor//codex/ trees, manifest.json and skills/CLAUDE.md router no longer exist, so none are touched here.
• node scripts/validate.mjs passes.

Review notes

• Sources: public Contentstack docs, including the Assets API search page. Features not publicly documented are omitted or deferred to the docs. Image editing is intentionally left out.
• Search section: the public page documents $and/$or, search_field values, headers and paging. It does not list the comparison operators, the $regex restriction, the spaces[].workspace field or user-defined field paths. Those come from the engineering team's source review, and the skill tells users to test their filters. Please confirm with the Assets API owner or trim them. spaces uses the documented plain array of UIDs, and the skill lists the regional hosts.
• Field types: the skill says the currently supported user-defined field types are single line text, number, select and group. The public "About asset modeling" page still lists Select as planned, so that page may need updating.
• Release: version bumped to 0.3.0 in all plugin manifests, with a CHANGELOG.md entry. Targets next, per review.

🤖 Generated with Claude Code

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	0	10	✅ Passed
🟠 High Severity	0	0	25	✅ Passed
🟡 Medium Severity	0	0	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

✅ BUILD PASSED - All security checks passed

[timbenniks-contentstack]

Nice work on this. The skill is well structured and the facts I spot-checked (14-day trash window, folder restore options, asset_fields[]) match the docs. A few things before we merge:

Must fix

• POST /api/search section: as you flagged, it isn't in the public docs. It also has no host, path or auth, so an agent can't use it anyway. Let's drop it until the Assets API owner confirms it's customer-facing.
• Field types: the skill lists single line text, number, select and group. About asset modeling says only Single Line Textbox, Number and Group are supported today, with Select planned. If Select has shipped, the docs need updating. Either way, I'd soften "do not suggest other types" to "currently supported types are…" so it doesn't go stale.

Should fix

• Missed docs pages: docs/overview/introduction.md still says "six Contentstack product areas" and has no Assets row. docs/how-it-works/router.md has no row for asset-management.
• Routing goes one way: this skill sends stack-library questions to cms-assets, but the cms-assets description ("images and other media files in Contentstack") will also catch DAM questions. Add a line there that sends Assets DAM questions (spaces, workspaces, duplicate sets) to asset-management.
• Leftover: step 2 of the Workflow Summary still lists "editing" from the removed section.
• PR description: it still mentions manifest.json, skills/CLAUDE.md, the cursor/rules/ regeneration and a count of 22. Can you update it to match what's in the PR now?

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	0	10	✅ Passed
🟠 High Severity	0	0	25	✅ Passed
🟡 Medium Severity	0	0	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

✅ BUILD PASSED - All security checks passed

[Mun-GitHub]

Thanks for the review. All points are addressed in 518945d and 0cbde4a, and the PR description is updated.

Must fix

• POST /api/search: The endpoint is public (Assets API search), so I kept the section and rewrote it against that page: POST https://am-api.contentstack.com/api/{object_type}/search, the auth headers (Bearer token or authtoken, no management token), x-cs-api-version, search_field values, $and/$or, and paging. The public page doesn't list the comparison operators, the $regex restriction, spaces[].workspace or user-defined field paths. Those come from an engineering source review, and the skill tells users to test their filters. If the Assets API owner would rather keep this to what's documented, I'll trim those lines.
• Field types: Reworded to "currently supported" and pointing to the Asset Modeling docs. Select is supported, so the About asset modeling page looks out of date and may need a docs update.

Should fix

• Docs pages: Added Assets to docs/overview/introduction.md (now seven product areas) and to the trigger table in docs/how-it-works/router.md.
• Routing: cms-assets (skill and docs page) is now scoped to the stack asset library. It sends DAM questions to asset-management, and also says user-defined fields can't be read or updated there, so those requests go to the Assets (DAM) API.
• Leftover "editing": Removed from the Workflow Summary.
• PR description: Rewritten to match the current diff.

node scripts/validate.mjs passes. I haven't bumped the version or touched CHANGELOG.md, so that's left to you for release.

[timbenniks-contentstack]

Thanks, nearly there. Most of the review is addressed. A few things left:

Search section (checked against the public docs)

• spaces shape: the search page example passes a plain array of UIDs ("spaces": ["amaa…"]), not { space_uid, workspace } objects. Please use the documented shape unless the API owner confirms the object form.
• Regional hosts: the skill hard-codes am-api.contentstack.com. The API overview lists NA, EU (eu-am-api.contentstack.com), Azure NA and GCP NA. Please list them or link to that page. (The docs themselves disagree on NA, .io vs .com, which is worth flagging to the docs team.)
• Env vars: the Environment Variables section suggests CONTENTSTACK_MANAGEMENT_TOKEN, but this API rejects management tokens. Use something like CONTENTSTACK_AUTHTOKEN or an OAuth token variable.

Minor

• docs/skills/asset-management.md still lists the field types flatly. Match the "currently supported" wording from the skill.
• The padding on the Products covered row in the docs/README.md table is off.

Process

• Please retarget this PR to next. We integrate there and ship to main in one PR.
• Please bump the version to 0.3.0 in .claude-plugin/plugin.json, .claude-plugin/marketplace.json, .cursor-plugin/plugin.json, plugin.json and gemini-extension.json, and add a ## 0.3.0 section to CHANGELOG.md for the new skill and the cms-assets routing change.

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	0	10	✅ Passed
🟠 High Severity	0	0	25	✅ Passed
🟡 Medium Severity	0	0	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

✅ BUILD PASSED - All security checks passed

[Mun-GitHub]

Thanks Tim. Everything is addressed in 6d6f041, and the PR now targets next.

Search section

• spaces: Now the documented plain array of UIDs ("spaces": ["<space_uid>"]). The { space_uid, workspace } form is gone.
• Regional hosts: The skill lists the AWS NA, AWS EU, Azure NA and GCP NA hosts and links the API overview. It also flags that the overview shows the AWS NA host as .io and the search page shows .com. That mismatch is worth raising with the docs team.
• Env vars: Replaced the management-token variable with CONTENTSTACK_AUTHTOKEN or CONTENTSTACK_OAUTH_ACCESS_TOKEN, plus CONTENTSTACK_ORGANIZATION_UID. The skill now says the Assets API doesn't accept management tokens.

Minor

• docs/skills/asset-management.md now uses the "currently supported" wording for field types.
• Fixed the padding on the Products covered row in docs/README.md.

Process

• Retargeted to next.
• Bumped to 0.3.0 in .claude-plugin/plugin.json, .claude-plugin/marketplace.json, .cursor-plugin/plugin.json, plugin.json and gemini-extension.json.
• Added a ## 0.3.0 section to CHANGELOG.md for the new skill and the cms-assets routing change.

node scripts/validate.mjs passes at 0.3.0. The operators, $regex and user-defined field path lines are still from the engineering source review, not the public page. If the API owner would rather keep to what's documented, I'll trim them.

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	0	10	✅ Passed
🟠 High Severity	0	0	25	✅ Passed
🟡 Medium Severity	0	0	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

✅ BUILD PASSED - All security checks passed