Use this skill to convert developer sandbox, free trial, API key, plugin testing, webhook, synthetic data, quota abuse, token mining, spam, fake app, marketplace certification, and sandbox trust questions into a concrete artifact with owners, gates, metrics, and recovery paths.
Workflow
- Identify sandbox entry points, developer identity, API keys, tokens, data boundaries, risky capabilities, quota model, fraud signals, review paths, support burden, and graduation criteria.
- Read
references/developer-sandbox-abuse-prevention-patterns.md. - Classify the situation as open signup sandbox, invite-only sandbox, marketplace integration sandbox, API trial, certification environment, high-risk capability request, suspected abuse spike, or graduation-to-production review.
- Define environment isolation, synthetic data policy, quota ladder, risky capability gates, abuse detection, graduated trust, manual review, appeal path, developer messaging, and production promotion gate.
- Produce sandbox abuse prevention review, state machine, decision table, event schema, control checklist, queue policy, and developer-safe mitigation plan.
When not to use
- Do not use for generic advice the base model already handles without this skill's specific artifact contract.
Guardrails
- Do not solve abuse only by adding signup friction that destroys legitimate developer activation.
- Do not allow sandbox credentials, webhooks, or test data to reach production customers or real regulated data.
- Do not expose fraud rules or exact thresholds in developer-facing messaging.
- Do not make automated risk scores final without review, appeal, and false-positive monitoring for high-impact actions.
Output format
Developer sandbox context:
Audience / source of truth / risk boundary:
Sandbox abuse control plan:
| Area | Decision | Evidence | Risk | Owner |
| --- | --- | --- | --- | --- |
Entry points, quotas, risky capabilities, signals, review queues, appeals, and graduation gates:
- <trigger> -> <policy, metric, edge case, support note>