How do I install the Backstage Integrations skill?

Run npx skillmds@latest add paulasilvatech/backstage-integrations-2 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Backstage Integrations safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Backstage Integrations?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Backstage Integrations free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Backstage Integrations?

paulasilvatech (@paulasilvatech) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Backstage Integrations by paulasilvatech

Name: Backstage Integrations
Author: paulasilvatech

File contents

Backstage External Integrations

Conventions

Use the least-privilege credential type supported by the provider, preferring GitHub Apps, managed identity, workload identity, or short-lived delegated tokens.
Keep provider sign-in, catalog discovery, backend service access, and user-delegated actions as separate trust boundaries.
Resolve credentials from environment-backed secret stores and keep them out of catalog entities, logs, and frontend config.
Scope organizations, repositories, projects, tenants, and subscriptions explicitly; reject requests outside the configured boundary.
Bound scheduled discovery and event processing with stable task IDs, timeouts, retries, and idempotency.
Validate webhook signatures and event provenance before processing.
Normalize provider failures into safe integration errors while retaining redacted correlation metadata.
Keep provider-specific code behind typed adapters so catalog and UI contracts remain stable.

Verification

Integration tests use fixtures or mocks rather than production credentials.
Permission scopes are documented by the owning configuration and match actual operations.
Discovery, webhook replay, throttling, and provider-unavailable paths remain deterministic.

Do / Do Not

Do	Do not
Keep providers behind typed adapters and test bounded failure behavior.	Couple catalog or UI contracts to provider-specific response objects.
Use fixtures and least-privilege scopes.	Test with production credentials or broaden permissions implicitly.

Checklist Before Opening a PR

The change matches this instruction's applyTo scope.
Adapter contracts and permission scopes match actual operations.
Discovery, replay, throttling, and unavailable-provider cases are tested.
Fixtures contain no production credential or private tenant data.
No unrelated edits or unresolved placeholders remain.

---name: backstage-integrations-2description: Use when editing Backstage integrations with GitHub, Azure, Azure DevOps, or other external providers.---# Backstage External Integrations## Conventions- Use the least-privilege credential type supported by the provider, preferring GitHub Apps, managed identity, workload identity, or short-lived delegated tokens.- Keep provider sign-in, catalog discovery, backend service access, and user-delegated actions as separate trust boundaries.- Resolve credentials from environment-backed secret stores and keep them out of catalog entities, logs, and frontend config.- Scope organizations, repositories, projects, tenants, and subscriptions explicitly; reject requests outside the configured boundary.- Bound scheduled discovery and event processing with stable task IDs, timeouts, retries, and idempotency.- Validate webhook signatures and event provenance before processing.- Normalize provider failures into safe integration errors while retaining redacted correlation metadata.- Keep provider-specific code behind typed adapters so catalog and UI contracts remain stable.## Verification- Integration tests use fixtures or mocks rather than production credentials.- Permission scopes are documented by the owning configuration and match actual operations.- Discovery, webhook replay, throttling, and provider-unavailable paths remain deterministic.## Do / Do Not| Do | Do not || --- | --- || Keep providers behind typed adapters and test bounded failure behavior. | Couple catalog or UI contracts to provider-specific response objects. || Use fixtures and least-privilege scopes. | Test with production credentials or broaden permissions implicitly. |## Checklist Before Opening a PR- [ ] The change matches this instruction's `applyTo` scope.- [ ] Adapter contracts and permission scopes match actual operations.- [ ] Discovery, replay, throttling, and unavailable-provider cases are tested.- [ ] Fixtures contain no production credential or private tenant data.- [ ] No unrelated edits or unresolved placeholders remain.

Frequently asked questions

Backstage Integrations