Pulumi Brand Guide → Vale Sync Review

VerifiedCaution

Weekly drift check of the offline Vale mirror against the Pulumi brand guide served by the brand MCP server, opening a PR only when the mirror has fallen behind.

Sby Skills Guide Bot
DocumentationIntermediate
10/31/2026
Claude Code
#vale#brand-guidelines#terminology#style-linting#mcp

Recommended for

Automated summary

Compares the offline Vale mirror (styles/Pulumi/) against the Pulumi brand guide served by the brand MCP server and opens a catch-up pull request only when the mirror has drifted behind.

Strengths

  • Prioritizes deprecated and retired terminology, the fastest-rotting part of any brand mirror
  • Clearly separates rows deliberately left unmirrored from genuine gaps using the BRAND-SYNC.yaml manifest
  • Fails loudly when the brand MCP server is unreachable instead of guessing the guide's contents
  • Provides a clear rule-tiering scheme (Substitutions, RetiredNames, DeprecatedProductNames, unmirrored) with matching hedging in each message

Limitations

  • The supplied skill text cuts off mid-sentence in the rule-tiering section, leaving the final instruction incomplete
  • Tightly coupled to Pulumi infrastructure: hardcoded repo paths, BRAND-SYNC.yaml manifest, and the brand.pulumi.com MCP endpoint
  • Wholly dependent on brand MCP server availability, with no offline or fallback mode
When to use it

Use it to audit or catch up the Pulumi brand Vale rules against the authoritative guide, including the scheduled weekly brand-style-sync workflow.

When not to use it

Do not use it to author repo-owned style rules (Hugo mechanics, internal conventions) or to edit the brand guide itself, which lives in another repository.

Security analysis

Caution
Quality score87/100

No destructive, exfiltrating, or obfuscated operations: no curl|sh, no credential handling, no writes outside the mirror, explicit prohibition on pushing to master and on fabricating guide content when the MCP server is unavailable. The risk profile is that of a legitimate but powerful automation workflow — network fetch, file edits, git branch/PR creation, and lint execution — with a mild prompt-injection exposure via remote guide text that feeds generated rules and PR bodies. Caution rather than risky.

Findings
  • •Autonomous repo mutation + remote PR creation: the skill instructs the agent to edit Vale rule files, bump BRAND-SYNC.yaml, create a branch and open a GitHub PR. Bounded (explicitly 'never push to master', no-op on no drift), but it is a write-capable agent workflow with no declared allowed-tools constraining it.
  • •Untrusted remote content drives writes: rules and PR bodies are generated from text fetched over the network from https://brand.pulumi.com/mcp. Injected or malicious guide text would flow into repo files and PR descriptions; the skill has no instruction to treat fetched guide content as data rather than directives.
  • •Network egress to a third-party MCP endpoint is required; if that endpoint is compromised or spoofed, the 'source of truth' check is only as trustworthy as that service. Mitigating factor: the skill explicitly fails loudly on unreachable server rather than hallucinating content.
  • •Runs build/lint tooling (make lint-prose, make lint, vale) whose behavior is defined by repo files, i.e. execution surface depends on the host repository's Makefile/toolchain.
  • •No allowed-tools declared, yet the workflow requires network access to an MCP endpoint (https://brand.pulumi.com/mcp), shell execution (make lint/vale/git), branch creation, commits, and pushing to a remote / opening PRs. The capabilities should be declared explicitly so reviewers and agents can see the write/network surface.
  • •The skill instructs opening and pushing PR branches; this is legitimate but grants repository write capability, so it should run only in a scoped CI identity with no direct push rights to protected branches (the text does correctly forbid pushing to master).
  • •Minor prompt-injection surface: content fetched from the brand MCP server is treated as source of truth and compared against files, but the skill does not instruct the agent to treat fetched guide text as data rather than instructions.
How this analysis is made

Examples

Weekly drift check
Run the brand-vale-sync check and tell me whether the Vale mirror under styles/Pulumi/ has drifted from the Pulumi brand guide.
Retired names audit
Pull the terminology section from the pulumi-brand MCP server and verify every row in 'Retired and disallowed names' has a matching rule or an entry in the intentionally-unmirrored block.
On-demand sync PR
Do an on-demand brand sync: if the mirror is behind, open a PR that updates the Vale rules and explains any guide rules left intentionally unmirrored.

name: brand-vale-sync description: Weekly drift check of the offline Vale mirror (styles/Pulumi/) against the Pulumi brand guide served by the brand MCP server, with deprecated/retired terms as the priority. Opens a PR (ready for review when validation passes) only when the mirror has fallen behind; a clean run changes nothing and opens no PR. Invoked by the brand-style-sync workflow; also user-invocable for an on-demand check.

Brand → Vale sync review

The Vale rules under styles/Pulumi/ are an offline mirror of the mechanically enforceable subset of the Pulumi brand guide. The brand guide — served by the pulumi-brand MCP server (https://brand.pulumi.com/mcp) — is the source of truth; the mirror only follows. Your job: detect where the mirror has drifted behind the guide, and open a PR that catches it up.

If the brand MCP server is unreachable, stop and fail loudly. Do not guess at the guide's contents from memory or from cached prose in this repo — a sync against a hallucinated source is worse than no sync.

Scope

styles/Pulumi/BRAND-SYNC.yaml is the manifest: it maps each mirrored Vale rule to the brand section and subsection it tracks, and records last_synced (the date of the last sync that changed the mirror). Rules not listed there (AI-drafting tells, Hugo mechanics, repo conventions) are repo-owned — never "sync" them against the guide, and never edit the brand guide side of anything (that's pulumi/marketing-web).

Process

  1. Load the manifest (styles/Pulumi/BRAND-SYNC.yaml).

  2. Pull each brand section it references via the MCP server: get_guidelines({section: "terminology"}), writing-style, and voice.

  3. Compare, rule by rule. For each manifest entry, read the Vale rule file and check the guide content it mirrors. You are looking for:

    • Retired terms the mirror doesn't know — a row in the terminology section's "Retired and disallowed names" table with no corresponding entry in Substitutions.yml (replacement right in every context), RetiredNames.yml (replacement usually right, message hedges), or DeprecatedProductNames.yml (no single fixed replacement) — nor an entry in the "Intentionally unmirrored" block at the top of BRAND-SYNC.yaml, which records the rows that deliberately have no rule and why. Check all four before reporting a gap. This is the highest-value check: renamed products rot fastest.
    • Renamed or re-cased canonical names — a "Product names" row that Nomenclature.yml mis-canonicalizes or misses.
    • Mirror entries the guide no longer supports — a swap or token whose brand rule was changed or dropped. Flag these for removal.
    • Stale rule message:/link: text that misquotes the guide.
  4. Judge before you write. The mirror is deliberately narrower than the guide: only near-zero-false-positive, mechanically checkable rules belong in it (see the admission criteria in .claude/commands/docs-review/scripts/vale-deterministic-fixes.yaml). A guide rule with no safe regex (e.g. "runtime code" → "function serialization", where runtime has too many live meanings) is correctly absent — note it in the PR body as intentionally unmirrored rather than forcing a noisy rule. When adding a retired name, decide the tier:

    • single fixed replacement, right in every context → Substitutions.yml (auto-fixable, blocker)
    • replacement usually right, but the guide's carve-outs apply (historical prose, or a name mapping to more than one current term) → RetiredNames.yml (auto-fixable, blocker; the message asks the reader to confirm the swap fits the sentence)
    • no single fixed replacement → DeprecatedProductNames.yml (flag-only, blocker)
    • no safe regex at all → leave unmirrored and note it in the PR body

    All four tiers block. The tier decides how much the message hedges, not whether the finding may ship — BRAND-SYNC.yaml carries the same rule.

  5. Validate. Run Vale (make lint-prose ARGS=<a couple of touched content files> or vale on a scratch fixture exercising each new/changed token, positive and negative cases) to prove the rules compile and match as intended. Run make lint.

  6. Report.

    • Drift found: update the rule files and BRAND-SYNC.yaml (last_synced + any mapping changes), and open a PR titled vale: sync brand-guide mirror (<date>). The body must list every change as guide says X → mirror said Y → now Z, plus the intentionally-unmirrored notes.
    • No drift: change nothing. Don't bump last_synced, don't create a branch, don't commit, and don't open or update a PR -- a weekly date-bump PR is pure review noise. Report "in sync" (in CI, that's the run log; interactively, tell the user) with a one-line note per checked section, and stop. If a sync PR is already open, leave it alone.
    • Ready vs. draft: open the PR ready for review when validation passes, and as a draft only when it fails (say what failed in the body). A draft requests no review team and gets no pre-merge review, so it sits unnoticed. Tier placement (blocker vs. advisory) is still a human call, and the required approval from a review team is where it gets made.
    • Never push to master directly.

From the file to a first result

The download contains exactly the content displayed on this page. This copy may differ from the latest version in the source repository.

View the source and supporting files

This download contains SKILL.md only. Any scripts, references, templates and dependencies are not included. Get the required files from the source, preserving their directory structure, before continuing.

1. Download the file

Download SKILL.md

From the root of a test project, save the file as .skill-downloads/pulumi-brand-guide-vale-sync-review-mvg6txv1/SKILL.md, or use the command below. This folder is for inspecting the skill before installation.

Command for macOS/Linux or WSL: requires a POSIX shell and curl. On Windows without WSL, use the download button and create the folder manually.

mkdir -p '.skill-downloads/pulumi-brand-guide-vale-sync-review-mvg6txv1' && curl --fail --show-error --location 'https://skills-guides.com/api/skills/pulumi-brand-guide-vale-sync-review-mvg6txv1/download' --output '.skill-downloads/pulumi-brand-guide-vale-sync-review-mvg6txv1/SKILL.md.part' && mv '.skill-downloads/pulumi-brand-guide-vale-sync-review-mvg6txv1/SKILL.md.part' '.skill-downloads/pulumi-brand-guide-vale-sync-review-mvg6txv1/SKILL.md'

2. Check prerequisites

Read SKILL.md before using it. If it references scripts or external services, inspect them and prepare the required access in your test environment.

No recognized prerequisites section in this file. This does not mean it is self-contained: libraries, tools and access requirements may be mentioned elsewhere in the content or source repository.

The platforms on this page are catalog indications. The paths below follow tool documentation; they do not prove this skill has been run in those tools. No minimum tool version is confirmed for this listing.

3. Load the skill

After inspection, copy the complete folder into your project using one of the commands below, then open a new tool session. The command stops if a folder with the same name already exists: compare the files before replacing it.

Claude Code
test -f '.skill-downloads/pulumi-brand-guide-vale-sync-review-mvg6txv1/SKILL.md' && test -s '.skill-downloads/pulumi-brand-guide-vale-sync-review-mvg6txv1/SKILL.md' && mkdir -p '.claude/skills' && test ! -e '.claude/skills/brand-vale-sync' && cp -R '.skill-downloads/pulumi-brand-guide-vale-sync-review-mvg6txv1' '.claude/skills/brand-vale-sync'

OpenSkills

OpenSkills must already be installed. The local install/read procedure is checked with OpenSkills 1.5.0, which requires Node.js ≥ 20.6.0. Catalog slugs are not resolved automatically.

Official OpenSkills installation
openskills install './.skill-downloads/pulumi-brand-guide-vale-sync-review-mvg6txv1'

openskills read 'pulumi-brand-guide-vale-sync-review-mvg6txv1'

Reading should display the installed file content and its base directory. It does not run the skill or install its dependencies.

For an agent that reads AGENTS.md, then sync the index. This command changes AGENTS.md: review the diff before using it.

openskills sync

Manual method or another tool: attach SKILL.md to a conversation, or open it in an agent that can read files. Include any required supporting resources. No universal folder is recognized by every tool.

4. Try a first task

Use a short, synthetic input: an API endpoint, a small document or an interface brief. In a new conversation, attach the file or give the agent its path, then adapt this request:

Read .skill-downloads/pulumi-brand-guide-vale-sync-review-mvg6txv1/SKILL.md and apply its instructions to this example: [describe a test input]. Identify any missing files, dependencies or access. Produce the result requested by the skill without inventing data or running unreviewed scripts.

Expected result: output matching the skill instructions, or a precise list of missing prerequisites. A read confirmation alone does not validate a first use. If an external resource is unavailable, that path remains untested.

Related skills