Demo Scaffolding Skill

Generate complete, security-hardened demo platforms for Assistant Skills plugins in minutes instead of days.

What This Skill Does

Creates production-ready demo infrastructure similar to jira-demo, confluence-demo, and splunk-demo with:

Quick Start

Interactive Mode (Recommended)

python scripts/create_demo.py
# Interactive wizard guides you through configuration

Command Line Mode

python scripts/create_demo.py \
  --name github-demo \
  --product GitHub \
  --plugin github-assistant-skills \
  --plugin-source pypi \
  --api-url-var GITHUB_API_URL \
  --api-token-var GITHUB_TOKEN \
  --scenarios search,issues,repos,admin \
  --output ./github-demo

Dry Run

python scripts/create_demo.py --dry-run
# Shows what would be generated without creating files

Usage Examples

"Create a demo for my new GitHub Assistant Skills plugin"
"Scaffold a demo infrastructure for Slack plugin"
"Generate a demo project with mock API support"
"Set up demo environment similar to confluence-demo"

Configuration Options

Generated Structure

{demo-name}/
├── docker-compose.yml          # Production orchestration
├── docker-compose.dev.yml      # Development overrides
├── Makefile                    # 50+ dev/deploy targets
├── CLAUDE.md                   # Claude Code instructions
├── README.md                   # Project documentation
├── .gitignore
├── pyproject.toml              # Python linting config
│
├── queue-manager/              # Node.js WebSocket server
│   ├── server.js               # Main entry (modular)
│   ├── package.json
│   ├── Dockerfile
│   ├── config/                 # Configuration modules
│   ├── services/               # Business logic
│   ├── routes/                 # HTTP endpoints
│   └── handlers/               # WebSocket handlers
│
├── demo-container/             # Claude + plugin container
│   ├── Dockerfile
│   ├── entrypoint.sh
│   └── scenarios/              # Test scenarios
│
├── landing-page/               # Static web frontend
│   ├── index.html
│   ├── queue-client.js
│   └── styles.css
│
├── nginx/                      # Reverse proxy
├── observability/              # LGTM stack config
├── scripts/                    # Utility scripts
├── secrets/                    # Credentials template
└── .claude/                    # Claude Code commands

Security Features (Always Enabled)

All generated demos include these security measures:

1. Input Validation - Regex validation, whitelist enforcement
2. Rate Limiting - Connection and invite brute-force protection
3. Session Security - HMAC-SHA256 tokens, HttpOnly cookies
4. Container Security - Memory/CPU/PID limits, capability dropping
5. Credential Protection - Env-file secrets, cleanup on session end
6. HTTP Headers - Helmet.js with strict CSP
7. XSS Prevention - DOMPurify, HTML escaping
8. Path Traversal - Resolved path validation
9. WebSocket Security - Origin validation, rate limiting
10. Redis Security - Error handling, TTL enforcement
11. Docker Socket - Minimal privileges
12. Production Validation - SESSION_SECRET enforcement

Post-Generation Steps

After running the scaffolder:

cd {demo-name}

# 1. Configure credentials
cp secrets/example.env secrets/.env
# Edit secrets/.env with your API credentials

# 2. Start development environment
make dev

# 3. Generate invite URL
make invite-local

# 4. Access the demo
open http://localhost:8080

Related Skills

Reference Implementations

Templates are extracted from these production demos.