Skills DirectorySkills Directory
SkillsLearnSecurityCategoriesDocsCommunityBlog
Sign InSubmit Skill
Skills Directory

Security-tested agent skills for Claude, coding agents, and AI workflows.

Directory

  • Browse Skills
  • All Skills A–Z
  • Claude Skills
  • Claude Code Skills
  • Agent Skills
  • Categories
  • Submit a Skill

Learn

  • Learn Hub
  • Install Claude Skills
  • Write SKILL.md
  • Skills vs MCP
  • Directories Compared

Security

  • Security
  • Methodology
  • Secure Claude Skills
  • Security Badges

Company

  • About
  • Community
  • Blog
  • API Docs
  • Advertise

2026 Skills Directory. All rights reserved.

Back to skills

Wled

ASecurity

How to use @owlmeans/wled — the shared white-label contract — company info, custom styles, brand media and DNS shapes, their AJV schemas, the WL type constants and the single WL_PROVIDE protocol both sides bind. Auto-invoked when importing white-label types or schemas, or when adding a white-label provider.

3 stars
0 votes
0 copies
0 views
Added 9/22/2026
devopstypescriptgogitbackend

Security Analysis

A100/100

Scanned 9/22/2026

Install to Claude Code

$npx -y skills add owlmeans/common --skill wled --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Wled?

Add the live security badge to your README — it updates automatically with every re-scan.

Security grade badge for Wled
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/owlmeans-wled-common/badge)](https://www.skillsdirectory.com/skills/owlmeans-wled-common)

More formats (shields.io, HTML) on the badges page.

Download Zip
Files
SKILL.md
---
name: wled
description: How to use @owlmeans/wled — the shared white-label contract — company info, custom styles, brand media and DNS shapes, their AJV schemas, the WL type constants and the single WL_PROVIDE protocol both sides bind. Auto-invoked when importing white-label types or schemas, or when adding a white-label provider.
user-invocable: false
---
<!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->

# @owlmeans/wled

**Layer:** Core
**Install:** `"@owlmeans/wled": "^0.1.18-rc.26"` in `dependencies`

The contract only. It owns no service and reaches no store: it declares the white-label record
shapes, their schemas, and one entrypoint that the server side answers and the browser side calls.
Everything that produces a white-label record lives downstream.

## Key Exports

| Export | Description |
|--------|-------------|
| `wledEntrypoints.provide` | The `WL_PROVIDE` protocol — a backend `GET /wl/provide/:entity`, with typed params and no guard. Bind it; never redeclare it. |
| `WL_PROVIDE` | The protocol alias. Both `@owlmeans/server-wl` and `@owlmeans/web-wl` bind this exact declaration. |
| `WL_PROVIDE_PATH` | `'/wl/provide/:entity'` |
| `WL_TYPE_COMPANY_INFO`, `WL_TYPE_STYLES`, `WL_TYPE_MEDIA`, `WL_TYPE_DNS` | The `type` a provider stamps on the record it returns — `'company-info'`, `'styles'`, `'media'`, `'dns'` |
| `ProvidedWL<T>` | What one provider answers: `T & { type: string; exists: boolean \| null }` |
| `CompanyInfo` | `{ resource?, entityId, fullName, shortName, slug, description }` |
| `CustomStyles` | `{ resource?, entityId, font, colors }` — a whole theme record, not just the palette |
| `CustomFont`, `CustomColors` | `{ fontFamily, basicSize? }` (`basicSize` minimum 8), and a required `primaryColor` plus optional secondary/alert/success colours and their backgrounds |
| `CustomMedia`, `CustomBrand` | `{ brand: { squareLogo?, wideLogo? } }` — both are URLs |
| `CustomUrls` | `{ adminUrl, userUrl }` |
| `ProvideParams` | `{ entity: string }` — the one path param |
| `CompanyInfoSchema`, `CustomStylesSchema`, `CustomFontSchema`, `CustomColorsSchema`, `ColorSchema`, `ProvideParamsSchema` | The AJV schemas for the shapes above. `ajv` is a peer dependency |

## The provide contract

`WL_PROVIDE` answers one object per organization entity, keyed by **provider service alias** — not by
white-label type:

```typescript
import { WL_TYPE_MEDIA } from '@owlmeans/wled'
import type { CustomMedia, ProvidedWL } from '@owlmeans/wled'

// what a provider registered under the alias 'wl-logo' contributes
const media: ProvidedWL<CustomMedia> = {
  type: WL_TYPE_MEDIA,
  exists: true,
  brand: { wideLogo: 'https://…/wide.png' }
}
// → the response carries it as { 'wl-logo': media, 'wl-info': …, 'wl-styles': … }
```

So a reader picks a section by the alias it registered the provider under, and `type` tells it which
shape it is holding. `exists` is a tri-state: `true` a stored record, `false` a deliberate empty
default, `null` unknown.

## Rules

- **The declaration carries no guard.** Whatever binds `WL_PROVIDE` serves it anonymously unless
  it adds one, so every section a deployment registers is readable by anyone who can name an
  organization. Put nothing in a white-label record that is not meant to be public, or add a guard
  where the entrypoint is bound.
- `entityId`, `slug` and the `entity` param are declared with `EntityValueSchema` from
  `@owlmeans/auth`, a plain `{ type: 'string', minLength: 3, maxLength: 256 }` — it bounds length and
  nothing else, so a record id and a slug both pass (`CompanyInfo.slug` relaxes `minLength` to 0 on
  top of it). `EntityValueSchema` is `@deprecated` in favour of `EntitySlugValueSchema`, the identical
  schema it aliases; write new fields against the slug schema. What the `entity` param is expected to
  hold is the serving side's rule, not this package's — see the `server-wl` skill.
- `ColorSchema` accepts `#` followed by 3–8 hex digits (length 4–9), so a named CSS colour or an
  `rgb()` string fails it. That check runs only where `CustomColorsSchema` or `CustomStylesSchema` is
  actually applied — this package's own entrypoint filter validates the path params alone, so a
  package that stores styles must put the schema in its own filter or run it itself.
- `CustomStylesSchema` requires only `font` and `colors`, while the `CustomStyles` type also requires
  `entityId`. Construct the record from the type — an object that satisfies the schema can still be
  missing the id every provider keys on.
- Colours and fonts are all optional except `primaryColor` and `fontFamily` — a consumer must render
  with whatever subset it gets rather than assuming a full palette.

## Depends On

- `@owlmeans/entrypoint`, `@owlmeans/route`, `@owlmeans/auth`
- `ajv` (peer)

Server side binds the declaration through `@owlmeans/server-wl`; browser side through
`@owlmeans/web-wl`.

Attribution

owlmeansowlmeans
View sourceMore from owlmeans →
SSkills DirectorySkills Directory

Ship a skill? Prove it's safe.

Free 120-pattern security scan, letter grade, and an embeddable README badge.

Submit a skill

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments (0)

No comments yet. Be the first to comment!

SSkills DirectorySkills Directory

Ship a skill? Prove it's safe.

Free 120-pattern security scan, letter grade, and an embeddable README badge.

Submit a skill

Related Skills

Terraform Module Library

Build reusable Terraform modules for AWS, Azure, and GCP infrastructure following infrastructure-as-code best practices. Use when creating infrastructure modules, standardizing cloud provisioning, or implementing reusable IaC components.

397921 votes

sematext-otel

Wire a service's OpenTelemetry output to Sematext Cloud. Walks through region, App-type, instrumentation flow (managed OTLP endpoint vs Sematext Agent), and signal selection (traces/metrics/logs), then produces the exact env-var block and points at a runnable reference example in this repo. Invoke when instrumenting a new app for Sematext.

01 votes

Deployment Patterns

Deployment workflows, CI/CD pipeline patterns, Docker containerization, health checks, rollback strategies, and production readiness checklists for web applications. Use when setting up deployment infrastructure or planning releases.

2459130 votes

Babysit

Watch a pull request or review cycle until it is ready to merge. Use when asked to babysit, monitor, or keep checking PR comments, reviews, and CI until all actionable issues are resolved.

942310 votes

V7 Roster

Interact with the Paperclip control plane API for task coordination and governance. Use when checking assignments, updating issue status, posting comments, delegating work, managing routines, or calling Paperclip API endpoints.

805540 votes
View all in devops →