# Rules every skill follows

Every skill in the pack follows the same rules, defined in [`skills/stream/RULES.md`](https://github.com/GetStream/agent-skills/blob/main/skills/stream/RULES.md). They hold on every call, whether you reach a skill through [`/stream`](/agent-skills/docs/skills/stream/) or invoke it directly, so the entry point never changes how generated code behaves. The platform skills (`stream-swift`, `stream-android`, `stream-react-native`) add their own `RULES.md` on top for platform-specific concerns.

`RULES.md` is the full list. The rules below are the ones that shape what you see most.

## Never log or echo secrets

<Admonition type="warning">

API keys, server secrets and user tokens are routine in Stream code. The skills won't print them to your terminal, write them to log files or include them in any output they hand back to you. A secret that needs to live somewhere lives in environment variables or the standard Stream CLI config locations, never in agent-readable context.

</Admonition>

## Route moderation policy changes through the Dashboard

Moderation policies (blocklists, automod, content rules) can be edited via the API, but the [Dashboard](https://beta.dashboard.getstream.io) is the supported authoring surface, with versioning, review and audit. The skills direct you to the Dashboard for policy edits and use the API only to read state.

## Install with npm, and `--legacy-peer-deps` for Stream packages

For a new scaffold the skill installs with `npm` and passes `--legacy-peer-deps` for Stream packages, because the SDKs declare peer ranges that a plain install rejects. It never uses `bun`.

When adding Stream to an existing project, the skill matches whatever package manager is already in place. On `yarn` or `pnpm` it translates the install command to match, without changing the package names. The npm rule applies to fresh scaffolds only.

<Tabs>

```bash label="npm"
npm install stream-chat @stream-io/video-react-sdk --legacy-peer-deps
```

```bash label="yarn"
yarn add stream-chat @stream-io/video-react-sdk
```

```bash label="pnpm"
pnpm add stream-chat @stream-io/video-react-sdk
```

</Tabs>

## Keep React strict mode on

<Admonition type="note">

The skills work with strict mode enabled and never disable it, because it catches real lifecycle bugs that would otherwise surface in production. This shapes how clients connect on the web: see [`/stream-builder`](/agent-skills/docs/skills/stream-builder/) for the `new StreamChat()` and `useEffect` patterns it generates.

</Admonition>


---

This page was last updated at 2026-06-16T16:17:06.664Z.

For the most recent version of this documentation, visit [https://getstream.io/agent-skills/docs/concepts/skill-rules/](https://getstream.io/agent-skills/docs/concepts/skill-rules/).