npm install stream-chat @stream-io/video-react-sdk --legacy-peer-depsRules every skill follows
Every skill in the pack follows the same rules, defined in skills/stream/RULES.md. They hold on every call, whether you reach a skill through /stream or invoke it directly, so the entry point never changes how generated code behaves. The platform skills (stream-swift, stream-android, stream-react-native) add their own RULES.md on top for platform-specific concerns.
RULES.md is the full list. The rules below are the ones that shape what you see most.
Never log or echo secrets
API keys, server secrets and user tokens are routine in Stream code. The skills won't print them to your terminal, write them to log files or include them in any output they hand back to you. A secret that needs to live somewhere lives in environment variables or the standard Stream CLI config locations, never in agent-readable context.
Route moderation policy changes through the Dashboard
Moderation policies (blocklists, automod, content rules) can be edited via the API, but the Dashboard is the supported authoring surface, with versioning, review and audit. The skills direct you to the Dashboard for policy edits and use the API only to read state.
Install with npm, and --legacy-peer-deps for Stream packages
For a new scaffold the skill installs with npm and passes --legacy-peer-deps for Stream packages, because the SDKs declare peer ranges that a plain install rejects. It never uses bun.
When adding Stream to an existing project, the skill matches whatever package manager is already in place. On yarn or pnpm it translates the install command to match, without changing the package names. The npm rule applies to fresh scaffolds only.
Keep React strict mode on
The skills work with strict mode enabled and never disable it, because it catches real lifecycle bugs that would otherwise surface in production. This shapes how clients connect on the web: see /stream-builder for the new StreamChat() and useEffect patterns it generates.