preset-apilisted

# preset-api Use as the prerequisite for direct Preset API skills. If the user is working through Preset/Superset MCP tools, stay on MCP unless they approve direct API calls. ## Always - Keep `PRESET_CLIENT_ID`, `PRESET_CLIENT_SECRET`, and tokens out of source, logs, reports, and examples. - When checking whether credential environment variables are present, use a zsh-safe `printenv "$VAR_NAME"` pattern. Do not use bash-only indirect expansion such as `${!var}`. - Read and format JSON responses with `curl ... | jq`: use `jq -r` when capturing scalar shell values such as tokens, IDs, and hostnames; use plain `jq` for structured JSON output; do not use inline `python -c` parsers. For reusable parsing, load `skills/preset-api/examples/preset_client.py` instead of improvising. - Use the workspace hostname or API base URL directly when it is already known from trusted context (for example, an earlier Management API response or user-supplied configuration); derive it through the Management API when provenance is missing. - Run reads directly: metadata reads always; customer-data reads (chart data, samples, distinct values, existing screenshots/thumbnails, own query history) when the user asked in their own message, with row limits as request parameters and summarized output. - Require explicit confirmation before mutations, imports, role/RLS changes, guest-token creation, permalink creation, screenshot/thumbnail cache generation, cache invalidation, all asset exports, credential