GEOrank Operator

Workflow

Resolve every relative path below from this Skill directory, independent of the caller's current workspace.

1. Confirm the target GEOrank base URL. Use http://localhost:8000 only for a local instance; require HTTPS for remote instances.
2. Resolve authentication:
   • Treat login as an ordinary-user flow and never ask the user to choose a role.
   • Run python3 scripts/georank_client.py login --account <account> when no session exists.
   • Run python3 scripts/georank_client.py whoami after login. Enable administrator branches only when the returned role is admin; treat enterprise as a regular authenticated user.
3. Read references/user-capabilities.md for public and user-owned operations. Read references/admin-capabilities.md only for administrator requests.
4. For reads, call the API directly with scripts/georank_client.py call GET <path>.
5. For writes, run the same command without --execute first and show the preflight result. Execute only after the user's request clearly authorizes that exact change.
6. Before any administrator mutation, read references/safety-policy.md and supply its required confirmation phrase. Never infer administrator authority from the wording of a request.
7. Return an execution receipt containing the action, status, resource identifiers, request ID when present, and the next safe step. Remove passwords, tokens, API keys, and other secrets from all output.

Safety Boundary

• Never pass passwords or tokens as command-line arguments. Login reads GEORANK_PASSWORD or uses a hidden terminal prompt; API calls read GEORANK_TOKEN or the private session file.
• Never expose, copy, or persist a secret outside the session store managed by the client.
• Treat every non-read call as a side effect. --execute is required.
• Require APPLY_ADMIN_CHANGE for administrator writes and DELETE:<api-path-with-query> for deletions.
• Stop when the detected role lacks permission, the target resource is ambiguous, or rollback information is unavailable for a high-impact change.

Output Contract

Return a compact Markdown or JSON receipt with:

• detected access level: public, user, or admin
• operation and target resource
• dry-run or executed status
• API status, resource IDs, and request ID when available
• redacted change summary and next step
• rollback guidance for administrator changes

Reference Map

• references/user-capabilities.md: public and ordinary-user operations.
• references/admin-capabilities.md: administrator operation groups and confirmation requirements.
• references/safety-policy.md: authentication, secrets, side effects, polling, and rollback rules.
• scripts/georank_client.py: deterministic login, session, role detection, preflight, and API execution.
• evals/trigger_cases.json: routing positives, negatives, and near neighbors.
• examples/request_payloads.json: file-backed fixture examples listed by input_files.
• reports/output-risk-profile.md: likely output failures and repair checks.
• reports/output_quality_scorecard.md: current output and verification evidence.
• reports/security_trust_report.md: generated trust report after validation.