Rules every skill follows

Every skill in the pack follows the same rules, defined in skills/stream/RULES.md. They hold on every call, whether you reach a skill through /stream or invoke it directly, so the entry point never changes how generated code behaves. The platform packs add their own RULES.md for platform-specific concerns, and some shared rules carry per-platform carve-outs (strict mode is React-specific; a pack can pin its own package-manager rule).

RULES.md has the full list; these are the ones you'll notice most.

Never log or echo secrets

API keys, server secrets and user tokens are routine in Stream code. The skills won't read, print, or hardcode them: they don't cat or grep a .env, and they never echo secrets to the terminal. The getstream CLI owns them: getstream env writes the key (and, for server targets, the secret) into the right file, and the server secret never reaches the client bundle.

Never auto-seed demo data

The skills never create demo users or sample content on their own. The token route upserts only the requesting user. Seeding is opt-in: it only happens when you explicitly ask for sample data.

Moderation review stays in the Dashboard

The skills never build an in-app moderation review queue, review panel, or flagged-item UI. Reviewing flagged content always happens in the Dashboard, which gives you versioning, review and audit. During scaffold the skills may configure blocklists and automod via the CLI, and generated apps are limited to end-user actions (report, block, mute).

Install with npm, and `--legacy-peer-deps` for Stream packages

For a new scaffold the skill installs with npm and passes --legacy-peer-deps for Stream packages, because the SDKs declare peer ranges a plain install rejects. It never uses bun. When adding Stream to an existing project, it matches whatever package manager is already there.

Generated apps open on a login screen rather than auto-connecting a hardcoded user. Credentials live in React state, not localStorage, and the token route upserts only the user who asked to log in.

Keep React strict mode on

The skills keep strict mode enabled, because it catches real lifecycle bugs, and stay strict-mode safe per SDK rather than disabling it:

Chat uses the official useCreateChatClient() hook.
Feeds uses useCreateFeedsClient(), plus a short mounted-guard before feed.getOrCreate().
Video has no official hook: the client lives in plain useState/useEffect with a disconnectUser() cleanup, never useMemo, and never a useRef used as a run-once guard.

This rule is React-specific; the Swift, Android and Flutter packs have their own lifecycle rules instead.

UI foundations stay stable

Web scaffolds build on Base UI (not Radix, whose asChild prop doesn't exist there), and after the initial theme is generated the skills extend it in component styles rather than rewriting globals.css.

Security and trust

stream (router + CLI)