Snowflake Native App Release Sheriff

What it does

When your agent uses it

• Reviewing manifest/setup safety
• Security-scan gates
• Version and release-directive validation
• Privilege changes

Example prompts

• “Native App release”
• “application package scan”
• “upgrade cohort”
• “/snowflake-native-app-release-sheriff”

Requirements

• Python 3
• Compatibility (from SKILL.md): Model-agnostic; Python 3.10+; optional Snowflake CLI for live provider-side read-only collection
• Pre-approved tools (allowed-tools): Read, Bash(python3:*)

Workflow steps

4 steps, taken from the first numbered list in SKILL.md.

1. 1Collect all three live provider surfaces for one exact package.
2. 2Build the schema-2 packet with owner-approved denominators and trusted hashes.
3. 3Run the analyzer at an explicit UTC evaluation time.
4. 4Stop on invalid, blocked, stale, capped, or incomplete evidence; hand a clean

What it can do on your machine

Read from SKILL.md and the folder at commit cfae287. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves these tools, so the agent can use them without asking each time:

  • Read
  • Bash(python3:*)

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  Ships 6 files in scripts/ (Python), which the agent can run.

  Shell commands in SKILL.md call:

  • python3

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  No URLs in SKILL.md.

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names no API keys, tokens, secrets or passwords.

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

• Compatibility

  Model-agnostic; Python 3.10+; optional Snowflake CLI for live provider-side read-only collection

  From compatibility in the SKILL.md frontmatter.

Context cost

Snowflake Native App Release Sheriff loads about 2k tokens when it runs, and up to ~4k if it reads all its reference files. Until then it costs about 122 tokens; SKILL.md has 767 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~122

When it runs · the whole SKILL.md, loaded when a task matches

~2k

With references · SKILL.md plus every file in references/, read only if the agent opens them

~4k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from jeremylongshore/tons-of-skills-marketplace at commit cfae287, republished under its MIT licence (© jeremylongshore). 767 words, ~2,033 tokens.

name

snowflake-native-app-release-sheriff

description

Preflight Snowflake Native App package releases from trusted, privacy-safe provider evidence without publishing, upgrading, altering, granting, or approving anything. Use when reviewing manifest/setup safety, security-scan gates, version and release-directive validation, App Spec or privilege changes, upgrade-cohort compatibility, and rollback readiness. Trigger with "Native App release", "application package scan", "upgrade cohort", or "App Spec".

allowed-tools

Read, Bash(python3:*)

compatibility

Model-agnostic; Python 3.10+; optional Snowflake CLI for live provider-side read-only collection

argument-hint

[schema-2-native-app-evidence.json]

version

3.16.0

author

Jeremy Longshore <jeremy@intentsolutions.io>

license

MIT

model

inherit

effort

high

tags

saas, snowflake, native-app, release, security, upgrade, rollback

python3 "${CLAUDE_SKILL_DIR}/scripts/collect_snowflake_evidence.py" \
  --surface native-app-versions-current --application-package APP_PACKAGE \
  --connection native-app-observer --output ./versions.json

python3 "${CLAUDE_SKILL_DIR}/scripts/collect_snowflake_evidence.py" \
  --surface native-app-release-directives-current --application-package APP_PACKAGE \
  --connection native-app-observer --output ./directives.json

python3 "${CLAUDE_SKILL_DIR}/scripts/collect_snowflake_evidence.py" \
  --surface native-app-upgrade-cohorts-current --application-package APP_PACKAGE \
  --connection native-app-observer --output ./cohorts.json

python3 "${CLAUDE_SKILL_DIR}/scripts/analyze_native_app_release.py" \
  --input ./native-app-evidence.json --evaluated-at "$EVALUATED_AT_UTC" \
  --trusted-input-sha256 sha256:... \
  --trusted-manifest-sha256 sha256:... \
  --trusted-setup-sha256 sha256:... \
  --trusted-cohort-sha256 sha256:... \
  --trusted-lifecycle-sha256 sha256:... \
  --trusted-rollback-sha256 sha256:... \
  > ./native-app-preflight.json

© jeremylongshore, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 14 other files (scripts, references) in skills/.curated/snowflake-native-app-release-sheriff of jeremylongshore/tons-of-skills-marketplace.

• SKILL.md
• eval-spec.yaml
• fixtures/incompatible-versions.json
• fixtures/missing-scans.json
• fixtures/partial-setup-failure.json
• fixtures/removed-grants.json
• fixtures/safe-cohorts.json
• references/evidence-contract.md
• references/source-notes.md
• scripts/analyze_native_app_release.py
• scripts/collect_snowflake_evidence.py
• scripts/sql/native-app-release-directives-current.sql
• scripts/sql/native-app-upgrade-cohorts-current.sql
• scripts/sql/native-app-versions-current.sql
• scripts/test_analyze_native_app_release.py

Open the folder on GitHubat commit cfae287