How long does the integration take?

Change one base URL in an OpenAI-compatible client, or install the Python or TypeScript SDK; the quickstart routes a first request in a few minutes.

Will this lock us into another vendor?

No. The router is Apache-2.0 open source, your provider keys stay yours, and the API is OpenAI-compatible, so leaving is a change of base URL.

What happens when a provider fails?

The router falls back to the next model your policy allows and records the fallback in the trace, so an outage costs a retry, not an incident.

14.05-cates-security-least-privilege - Prompt

Name: 14.05-cates-security-least-privilege
Author: autocloudarc-digital-services

Prompt file imported from autocloudarc-digital-services/ghcp-dotnet-calculator (.github/prompts/14.05-cates-security-least-privilege.prompt.md). Copyright stays with the author.

Remediate CATES Security

Objective

Resolve applicable SEC, MCP, setup, agent, hook, command, and editor-permission findings inside the sample repository.

Required Steps

Read cates-exercises/05-cates-security-least-privilege.md.
Verify the fixture contains no real or provider-shaped credentials.
Restrict the sample agent to explicit read-focused tools and narrow scope.
Keep approval boundaries for shell and write operations.
Pin the MCP package, use HTTPS remotely, retain environment references, and add concise server descriptions.
Reduce nested setup workflow permissions and add test/lint preparation.
Replace the heavy interactive or container hook with a fast noninteractive check or move it to the nested CI example.
Run structure validation and stable analysis.
Save reports/05-security.json.

Prohibited Fixture Content

Do not create examples shaped like live provider tokens, cloud access keys, private keys, personal identifiers, or production endpoints. Use descriptive placeholders and environment references.

Validation

Confirm no critical finding was introduced and summarize the least-privilege change for every modified surface.

# Remediate CATES Security ## Objective Resolve applicable SEC, MCP, setup, agent, hook, command, and editor-permission findings inside the sample repository. ## Required Steps 1. Read `cates-exercises/05-cates-security-least-privilege.md`. 2. Verify the fixture contains no real or provider-shaped credentials. 3. Restrict the sample agent to explicit read-focused tools and narrow scope. 4. Keep approval boundaries for shell and write operations. 5. Pin the MCP package, use HTTPS remotely, retain environment references, and add concise server descriptions. 6. Reduce nested setup workflow permissions and add test/lint preparation. 7. Replace the heavy interactive or container hook with a fast noninteractive check or move it to the nested CI example. 8. Run structure validation and stable analysis. 9. Save `reports/05-security.json`. ## Prohibited Fixture Content Do not create examples shaped like live provider tokens, cloud access keys, private keys, personal identifiers, or production endpoints. Use descriptive placeholders and environment references. ## Validation Confirm no critical finding was introduced and summarize the least-privilege change for every modified surface.

Install 14.05-cates-security-least-privilege and it becomes one more candidate the router can pick - when it fits.

A listing is a routing target with a manifest: what it does, which domains it covers, what it costs and who publishes it. Once installed it sits beside your own models and tools, is scored like any other candidate for each request, and shows up in the trace when it wins. Ratings come from workspaces that installed it, one per account.

{ "prompt": "# Remediate CATES Security\n\n## Objective\n\nResolve applicable SEC, MCP, setup, agent, hook, command, and editor-permission\nfindings inside the sample repository.\n\n## Required Steps\n\n1. Read `cates-exercises/05-cates-security-least-privilege.md`.\n2. Verify the fixture contains no real or provider-shaped credentials.\n3. Restrict the sample agent to explicit read-focused tools and narrow scope.\n4. Keep approval boundaries for shell and write operations.\n5. Pin the MCP package, use HTTPS remotely, retain environment references, and\n add concise server descriptions.\n6. Reduce nested setup workflow permissions and add test/lint preparation.\n7. Replace the heavy interactive or container hook with a fast noninteractive\n check or move it to the nested CI example.\n8. Run structure validation and stable analysis.\n9. Save `reports/05-security.json`.\n\n## Prohibited Fixture Content\n\nDo not create examples shaped like live provider tokens, cloud access keys,\nprivate keys, personal identifiers, or production endpoints. Use descriptive\nplaceholders and environment references.\n\n## Validation\n\nConfirm no critical finding was introduced and summarize the least-privilege\nchange for every modified surface.", "variables": [], "notes": "Remediate CATES security and least-privilege findings in the isolated fixture without introducing realistic credential material.", "metadata": { "source": { "provider": "github-prompts", "repository": "https://github.com/autocloudarc-digital-services/ghcp-dotnet-calculator", "path": ".github/prompts/14.05-cates-security-least-privilege.prompt.md", "ref": "d2ead9d33cce10fe637b2755f481c03c74bf1955", "url": "https://github.com/autocloudarc-digital-services/ghcp-dotnet-calculator/blob/d2ead9d33cce10fe637b2755f481c03c74bf1955/.github/prompts/14.05-cates-security-least-privilege.prompt.md", "key": "autocloudarc-digital-services/ghcp-dotnet-calculator/.github/prompts/14.05-cates-security-least-privilege.prompt.md" } }, "model_hints": [ "GPT-6.1 Sol (copilot)" ] }

14.05-cates-security-least-privilege

About

Remediate CATES Security

Objective

Required Steps

Prohibited Fixture Content

Validation

Use it

Install 14.05-cates-security-least-privilege and it becomes one more candidate the router can pick - when it fits.

What it costs to adopt - in engineering time.

One base URL

No vendor lock-in

Failover built in

Manifest

Reviews