# Data Room Skill

> Shared rules for the data-room-skill bundle (data-room, room-access, room-engagement). Loaded by the individual skills for the common ReportRoom gate, limits, and safety rules. Not invoked directly — pick the specific skill for the job.

- Skill: `dashaworks/data-room-skill` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add dashaworks/data-room-skill`
- Raw SKILL.md: https://api.skillmd.com/api/skills/dashaworks/data-room-skill/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: dashaworks (https://skillmd.com/u/dashaworks)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/dashaworks/data-room-skill

---


# Data Room Skills — shared rules

All three skills operate ReportRoom data rooms through the ReportRoom MCP server. This file holds what they share; each skill's SKILL.md holds only what differs.

## The gate (check before any room operation)

Call `account_status`. Data-room tools require **both**:

- the **Business plan** (not Free, Pro, or Team), and
- the caller to be the org **owner or an admin**.

If either is missing, say so plainly and offer the alternative (publishing documents normally, or a tracked proposal) rather than retrying. Never imply a room exists or a change was made when the entitlement check failed.

Limits: **10 live rooms per org, 200 viewers per room.** Deleting a room is an archive (its URL stops serving); there is no hard delete.

## Facts that hold everywhere (verified against the serving code)

- Access modes: `public` | `email` (magic link, default) | `passcode` | `allowlist`. Enforced at serve time.
- `nda_text` (accept-before-entry) and `expires_at` (room returns 410 after) are **enforced**.
- `watermark` and `allow_download` are stored but **not enforced yet** (Phase 2) — never tell the user a room is watermarked or download-locked.
- Access is **room-level**: every granted viewer sees every document in the room. Different audiences → different rooms.
- While a document is in a live room, its standalone URL is gated too — the room cannot be bypassed by opening the doc directly.
- Rooms are served `noindex`; regular published documents are public, indexable pages.
- Invite links from `grant_room_access` are shown **once**, never emailed by ReportRoom, and unrecoverable (re-grant to reissue).
- `get_room_analytics` is per-viewer, per-document (opens, events, dwell). Email/allowlist viewers are identified; passcode/public viewers appear as anonymous session ids.

## Safety rules (all three skills)

- Never fabricate or estimate diligence material — metrics, financials, cap-table figures go in exactly as the user supplies them; ask for missing numbers.
- Scan every document for secrets, keys, unredacted personal data, and third-party confidential material before it goes into a room.
- Never send an invite link to a recipient yourself unless the user explicitly asks; hand it to the user.
- Confirm access-mode and viewer changes back to the user before applying them — a wrong grant leaks a confidential room.

## Which skill for which job

| The user wants | Use |
|---|---|
| Build a new room (fundraise, M&A, board pack) | `data-room` |
| Invite, revoke, rotate a passcode, change NDA/expiry | `room-access` |
| Know who opened what, and what to do about it | `room-engagement` |