@raishin/vanguard-frontier-agentic 2.8.0 → 2.10.0

package/skills/netsuite/netsuite-application-developer-skill/metadata.json

@@ -0,0 +1,35 @@
+{
+  "id": "netsuite-application-developer-skill",
+  "name": "NetSuite Application Developer Skill",
+  "type": "skill",
+  "provider": "netsuite",
+  "harnesses": [
+    "claude-code",
+    "codex",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Reviews NetSuite SuiteScript 2.x code, SuiteFlow workflows, SuiteBuilder customizations, and UIF SPA components against Application Developer Professional standards. Depends on netsuite-suitescript-records-reference (272 record types) and netsuite-uif-spa-reference (@uif-js API) as upstream Oracle U",
+  "source_type": "adapted",
+  "category": "platform",
+  "execution_tier": "static-review",
+  "oauth_scopes": [],
+  "mcp_servers": [],
+  "run_as_permissions": {},
+  "sandbox_only": false,
+  "production_allowed": true,
+  "official_docs": [
+    "https://education.oracle.com/oracle-netsuite-application-developer-professional/pexam_N16304GC10",
+    "https://www.netsuite.com/portal/services/training/suite-training/netsuite-certification.shtml",
+    "https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_N285436.html",
+    "https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_N295396.html"
+  ],
+  "security_notes": "Static review only — never deploys, activates, or modifies any script, workflow, or customization in any NetSuite account. No credentials, session tokens, or API keys are requested or processed. Script run-as accounts reviewed must follow least-privilege posture with Administrator role explicitly forbidden.",
+  "last_verified": "2026-06-09",
+  "path": "skills/netsuite/netsuite-application-developer-skill",
+  "author": "github: Raishin",
+  "version": "0.1.0",
+  "source_attribution": "Adapted with DEPENDENCY on oracle/netsuite-suitecloud-sdk packages/agent-skills/netsuite-suitescript-records-reference and netsuite-uif-spa-reference (UPL-1.0, Copyright (c) 2019, 2023 Oracle and/or its affiliates). Vanguard additions: [FACT]/[ASSUMPTION]/[INFERENCE] evidence labeling, governance-limit severity classification, explicit SuiteScript 1.0 detection and escalation path, least-privilege run-as role enforcement, and Vanguard harness routing integration."
+}

package/skills/netsuite/netsuite-application-developer-skill/references/least-privilege.md

@@ -0,0 +1,64 @@
+# Least-privilege NetSuite posture for NetSuite Application Developer Agent
+
+## Execution tier
+
+**T0 — Static Review**
+
+Rationale: `execution_tier: "static-review"` declared in `metadata.json`. This agent reviews sanitized configuration excerpts and never holds a live NetSuite session.
+
+## Identity model
+
+No live NetSuite identity is required for the agent itself. When a human operator acts on this agent's review, they SHOULD use the least-privilege custom role below — never the Administrator role.
+
+## Recommended custom role
+
+- **Custom role name:** NetSuite App Developer Reviewer (custom)
+- **Copy from standard role:** Developer (NetSuite guidance: start from a copy of a standard role, then remove unneeded permissions).
+- **Modules in scope:** SuiteScript, SuiteBuilder, SuiteFlow, SuiteCloud Development Framework
+- **Two-Factor Authentication required:** Yes
+
+### Minimal permissions
+
+- **SuiteScript** (View) — Read script files and deployment records without modification
+- **SuiteFlow** (View) — Inspect workflow definitions and action configurations
+- **Custom Record Types** (View) — Review custom record definitions and field configurations
+- **Custom Fields** (View) — Validate custom field internal IDs and types
+- **Script Deployments** (View) — Inspect deployment records and run-as role bindings
+- **Log in using OAuth 2.0 Access Tokens** (Full) — Required for authenticated read-only API calls if used as run-as context; least-privilege scope only
+
+## Forbidden
+
+- Administrator role
+- Full permissions to any module
+- Edit or Create on Script Deployments for review-only sessions
+- Access Token Management permission
+
+## Blast-radius bound
+
+Even if fully compromised, this agent cannot mutate a NetSuite account: it has no live session, no API tokens, and no SDF deploy rights. It can only produce review text.
+
+## Refusal triggers
+
+- Any credentials, session tokens, API keys, or OAuth secrets included in the request
+- Request to deploy, activate, schedule, or execute any script or workflow in a live or sandbox account
+- Request to assume Administrator role or any role granting full account access
+- Request to run security penetration tests or exploit discovery — use netsuite-suitescript-secure-code-review-agent
+- Request to perform SDF project deployment or SuiteScript 1.0 migration — use netsuite-suitecloud-developer-agent
+- Coming-soon certification claimed as available for developer track extensions
+
+## Escalation path
+
+Route all live-account changes to `netsuite-live-org-mutation-guard-agent` with a named human decision owner and a structured case capsule.
+
+## Role creation steps
+
+1. In the target SANDBOX, copy the standard role named above to a new custom role.
+2. Remove every permission not listed under Minimal permissions.
+3. Add only the listed permissions at the stated access level.
+4. Confirm the role is NOT Administrator and grants no global/cross-subsidiary access beyond remit.
+5. Enable 2FA enforcement if the role touches privileged permissions.
+6. Test in sandbox, then assign to the integration/review user; monitor for least-privilege drift.
+
+## Companion skill
+
+`netsuite-application-developer-skill` — NetSuite Application Developer Skill

package/skills/netsuite/netsuite-application-developer-skill/references/official-sources.md

@@ -0,0 +1,10 @@
+# Official Sources
+
+Oracle Application Developer Professional exam and SuiteScript documentation URLs
+
+Verified 2026-06-09 against official Oracle/NetSuite documentation:
+
+- https://education.oracle.com/oracle-netsuite-application-developer-professional/pexam_N16304GC10
+- https://www.netsuite.com/portal/services/training/suite-training/netsuite-certification.shtml
+- https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_N285436.html
+- https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_N295396.html

package/skills/netsuite/netsuite-application-developer-skill/references/release-drift.md

@@ -0,0 +1,11 @@
+# Release Drift
+
+NetSuite release notes affecting SuiteScript APIs, SuiteFlow, and UIF components
+
+NetSuite releases biannually. Content verified 2026-06-09.
+
+Release-sensitive items to re-verify each release:
+
+- SOAP web services removal timeline (REST + OAuth 2.0 recommended for new integrations from 2026.1; new SOAP integrations blocked at 2027.1).
+- Certification availability (AI Specialist/Professional and BI & Reporting Professional are Coming Soon — re-check status).
+- AI Connector / MCP permission names and role restrictions.

package/skills/netsuite/netsuite-application-developer-skill/references/safety-checklist.md

@@ -0,0 +1,18 @@
+# Safety Checklist
+
+Governance limit, run-as role, and static-review safety gates
+
+- No live NetSuite connection, credentials, or session tokens used at any point
+- netsuite-suitescript-records-reference loaded before asserting field ID or record type compatibility
+- netsuite-uif-spa-reference loaded before asserting @uif-js API correctness
+- Governance limit violations rated Critical when synchronous path can exhaust account limits
+- SuiteScript 1.0 patterns escalated to netsuite-suitecloud-developer-agent, not handled here
+
+## Refusal triggers
+
+- Any credentials, session tokens, API keys, or OAuth secrets included in the request
+- Request to deploy, activate, schedule, or execute any script or workflow in a live or sandbox account
+- Request to assume Administrator role or any role granting full account access
+- Request to run security penetration tests or exploit discovery — use netsuite-suitescript-secure-code-review-agent
+- Request to perform SDF project deployment or SuiteScript 1.0 migration — use netsuite-suitecloud-developer-agent
+- Coming-soon certification claimed as available for developer track extensions

package/skills/netsuite/netsuite-application-developer-skill/references/script-type-reference.md

@@ -0,0 +1,14 @@
+# Script Type Reference
+
+SuiteScript 2.x script type entry-point and governance limit quick reference
+
+Scope: SuiteScript 2.x code quality, script-type correctness, SuiteFlow workflow logic, SuiteBuilder custom record and form design, and UIF SPA component architecture. Depends on netsuite-suitescript-records-reference and netsuite-uif-spa-reference as upstream reference skills (Oracle UPL-1.0).
+
+- SuiteScript 2.x: script type selection (ClientScript, UserEventScript, MapReduceScript, ScheduledScript, Suitelet, RESTlet, MassUpdateScript, WorkflowActionScript), entry-point correctness, module usage
+- Governance limit awareness: synchronous vs. asynchronous script limits, N/search usage limits, N/record load patterns
+- SuiteFlow workflow design: trigger conditions, action correctness, approval routing logic, workflow action scripts
+- SuiteBuilder customizations: custom record type design, custom field configuration, form layout, custom segments
+- UIF SPA component review: @uif-js/core and @uif-js/component API correctness, state management patterns, DataGrid and Form component usage
+- Script deployment configuration: record type binding, run-as configuration, deployment status
+- Error handling and logging patterns in SuiteScript 2.x
+- Script upgrade readiness: identifying SuiteScript 1.0 patterns requiring migration (escalate to netsuite-suitecloud-developer-agent for full SDF migration)

package/skills/netsuite/netsuite-audit-controls-sox-skill/SKILL.md

@@ -0,0 +1,86 @@
+---
+name: netsuite-audit-controls-sox-skill
+description: "Flashlight skill for reviewing NetSuite financial governance and SOX internal control configurations. T0 static review — no live account connection required. TRIGGER when: user asks to review segregation of duties, SoD conflicts, posting period controls, period-close procedures, revenue recognition schedules, approval workflow chains for journal entries or vendor bills, audit trail completeness, or SOX walkthrough evidence in NetSuite. Trigger phrases: SOX review, segregation of duties, SoD conflict, posting period locked, period close checklist, revenue recognition schedule, journal entry approval, audit trail, SOX material weakness, internal controls review. DO NOT TRIGGER when: request is about routine AP/AR transaction processing without a SOX angle (use netsuite-financial-foundations-agent), OAuth or TBA authentication setup (use netsuite-sso-oauth-tba-agent), SuiteFlow workflow syntax or builder mechanics (use netsuite-suiteflow-automation-agent), SuiteScript code security (use netsuite-suitescript-secure-code-review-agent), or live account mutation is required (use netsuite-live-org-mutation-guard-agent)."
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-06-09"
+  category: compliance
+  lifecycle: experimental
+  execution_tier: static-review
+  mcp_servers: []
+  oauth_scopes: []
+  run_as_permissions:
+    required: []
+    denied: []
+---
+
+# NetSuite Audit Controls SOX Skill
+
+## Purpose
+
+Validates that NetSuite financial control configurations meet SOX audit requirements: SoD conflicts across AP/AR/GL roles, posting period lock-down rules, multi-step journal entry approval chains, ASC 606 / VSOE revenue recognition setup, and audit trail integrity for all financial transactions. T0 static review — no NetSuite account connection required; output is a draft for human review.
+
+## When This Skill Owns the Task
+
+- User submits role permission exports or approval workflow definitions for SOX control review
+- Internal audit team needs SoD conflict analysis across AP, AR, GL, and payroll roles
+- External auditor requests SOX walkthrough documentation for NetSuite financial controls
+- CoE architect needs to validate posting period lock procedures and close-calendar coverage
+- Finance team needs revenue recognition schedule reviewed against ASC 606 / VSOE requirements
+
+## Recommended Workflow
+
+1. Step 1 — Collect sanitized inputs: request role permission exports, approval workflow definitions, posting period status, revenue recognition configuration, and audit trail coverage table
+2. Step 2 — SoD analysis: identify permission overlaps across AP entry, AP approval, AR entry, AR approval, GL posting, and cash management functions; rate each conflict
+3. Step 3 — Posting period review: verify lock/unlock sequence, confirm who holds Manage Accounting Periods, check that prior periods are locked before current period close
+4. Step 4 — Approval workflow audit: validate multi-step approval chains exist for journal entries, vendor bills, purchase orders, and expense reports; check for approval bypass conditions
+5. Step 5 — Revenue recognition review: confirm recognition method aligns to ASC 606 or VSOE requirements, deferral account mapping is correct, and schedule release is approval-gated
+6. Step 6 — Audit trail completeness: verify system notes are enabled for all financial transaction types; flag any transaction type missing field-history tracking
+7. Step 7 — Emit SOX findings report: rated Critical / High / Medium / Low with control deficiency categorization (deficiency / significant deficiency / material weakness) and safe-next-actions
+
+## Evidence Hierarchy
+
+LIVE_EVIDENCE > REPOSITORY_EVIDENCE > USER_PROVIDED > OFFICIAL_DOCUMENTATION > INFERENCE > UNVERIFIED > BLOCKED
+
+## Safety Checklist
+
+- No live NetSuite connection — all inputs are sanitized configuration excerpts
+- No credentials, tokens, consumer keys, or client secrets in submitted inputs
+- Role recommendations never include the Administrator role
+- 2FA designation verified for roles with Manage Accounting Periods or Access Token Management permissions
+- All SoD findings cite specific permission overlaps from submitted role exports, not from inference alone
+- Approval workflow bypass conditions (e.g., auto-approve for low amounts) are flagged and rated
+
+## Rules — Hard-Stop Constraints
+
+- Static review only; never connect to a live NetSuite account or invoke APIs/SuiteScript/SDF.
+- Never request or accept credentials, tokens, or secrets.
+- Never depend on the Administrator role; recommend least-privilege custom roles (note 2FA).
+- Prefer OAuth 2.0 (REST/RESTlets/SuiteAnalytics Connect) over SOAP; treat SOAP as a migration risk.
+- Never claim a Coming-Soon certification is available.
+
+## Refusal Triggers
+
+- Input contains credentials, tokens, consumer keys, client secrets, or any authentication material — stop and instruct sanitization
+- Request involves mutating, deploying, activating, or unlocking any NetSuite configuration in a live or production account — route to netsuite-live-org-mutation-guard-agent
+- Request asks the agent to log in, connect, or authenticate to any NetSuite environment
+- Claim that the Administrator role should be used for integration, review, or period-close operations — refuse and cite least-privilege principle (evidence-matrix rows 7a, 7b)
+- Request to assert status of the AI Specialist or AI Professional certifications as available — those are coming soon; only AI Foundations Associate (N16765GC10) is available (evidence-matrix row 1b)
+
+## T0 Contract
+
+No account connection, no OAuth, no secrets. Output is draft review text for a human owner.
+
+## Security Notes
+
+Static review only — works exclusively from sanitized configuration excerpts; never requests or accepts credentials, tokens, session IDs, consumer keys, or any authentication material. Does not connect to, query, or mutate any NetSuite account in any environment. Role recommendations explicitly exclude the Administrator role. 2FA designation requirements are surfaced for roles with Manage Accounting Periods or sensitive access-management permissions. SOX evidence artifacts are generated as draft documents for human reviewer sign-off only.
+
+## Reference File Index
+
+- [official-sources.md](references/official-sources.md) — Oracle NetSuite certification and financial governance help URLs verified in evidence-matrix
+- [safety-checklist.md](references/safety-checklist.md) — Pre-submission sanitization checklist for role exports and financial configuration excerpts
+- [least-privilege.md](references/least-privilege.md) — Custom role construction guidance for SOX reviewer posture derived from Accountant standard role
+- [release-drift.md](references/release-drift.md) — NetSuite release cadence notes for posting period engine and approval workflow changes
+- [sox-control-map.md](references/sox-control-map.md) — Mapping of SOX Section 302/404 control objectives to NetSuite configuration review areas

package/skills/netsuite/netsuite-audit-controls-sox-skill/metadata.json

@@ -0,0 +1,36 @@
+{
+  "id": "netsuite-audit-controls-sox-skill",
+  "name": "NetSuite Audit Controls SOX Skill",
+  "type": "skill",
+  "provider": "netsuite",
+  "harnesses": [
+    "claude-code",
+    "codex",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Flashlight skill for reviewing NetSuite financial governance and SOX internal control configurations. T0 static review — no live account connection required. TRIGGER when: user asks to review segregation of duties, SoD conflicts, posting period controls, period-close procedures, revenue recognition ",
+  "source_type": "original",
+  "category": "compliance",
+  "execution_tier": "static-review",
+  "oauth_scopes": [],
+  "mcp_servers": [],
+  "run_as_permissions": {},
+  "sandbox_only": false,
+  "production_allowed": true,
+  "official_docs": [
+    "https://www.netsuite.com/portal/services/training/suite-training/netsuite-certification.shtml",
+    "https://education.oracle.com/oracle-netsuite-accounting-professional/pexam_N16301GC10",
+    "https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_N285436.html",
+    "https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_N295396.html",
+    "https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_1532968056.html",
+    "https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_1515446005.html"
+  ],
+  "security_notes": "Static review only — works exclusively from sanitized configuration excerpts; never requests or accepts credentials, tokens, session IDs, consumer keys, or any authentication material. Does not connect to, query, or mutate any NetSuite account in any environment. Role recommendations explicitly exclude the Administrator role. 2FA designation requirements are surfaced for roles with Manage Accounting Periods or sensitive access-management permissions. SOX evidence artifacts are generated as draft documents for human reviewer sign-off only.",
+  "last_verified": "2026-06-09",
+  "path": "skills/netsuite/netsuite-audit-controls-sox-skill",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/netsuite/netsuite-audit-controls-sox-skill/references/least-privilege.md

@@ -0,0 +1,66 @@
+# Least-privilege NetSuite posture for NetSuite Audit Controls SOX Agent
+
+## Execution tier
+
+**T0 — Static Review**
+
+Rationale: `execution_tier: "static-review"` declared in `metadata.json`. This agent reviews sanitized configuration excerpts and never holds a live NetSuite session.
+
+## Identity model
+
+No live NetSuite identity is required for the agent itself. When a human operator acts on this agent's review, they SHOULD use the least-privilege custom role below — never the Administrator role.
+
+## Recommended custom role
+
+- **Custom role name:** NetSuite Audit Controls SOX Reviewer (custom)
+- **Copy from standard role:** Accountant (NetSuite guidance: start from a copy of a standard role, then remove unneeded permissions).
+- **Modules in scope:** Financial Management, Accounting, Revenue Recognition, Approval Workflows, Audit Logging
+- **Two-Factor Authentication required:** Yes
+
+### Minimal permissions
+
+- **Manage Accounting Periods** (View) — Inspect posting period lock/unlock status and close calendar without modifying period state
+- **Journal Entries** (View) — Review journal entry records and approval chain history for SOX walkthrough
+- **Vendor Bills** (View) — Inspect AP approval workflow coverage and SoD separation between invoice entry and payment
+- **Revenue Recognition** (View) — Review recognition schedules, deferral accounts, and ASC 606 arrangement allocation
+- **Audit Trail (System Notes)** (View) — Verify field-history tracking completeness across financial transaction types
+- **Workflow** (View) — Inspect approval workflow definitions and step configurations for SOX control evidence
+
+## Forbidden
+
+- Administrator role
+- Manage Accounting Periods at Edit or Full level
+- Full access to Journal Entries
+- Access Token Management permission
+- OAuth 2.0 Authorized Applications Management permission
+- View Unencrypted Credit Cards
+- View Unencrypted ACH Account Numbers
+
+## Blast-radius bound
+
+Even if fully compromised, this agent cannot mutate a NetSuite account: it has no live session, no API tokens, and no SDF deploy rights. It can only produce review text.
+
+## Refusal triggers
+
+- Input contains credentials, tokens, consumer keys, client secrets, or any authentication material — stop and instruct sanitization
+- Request involves mutating, deploying, activating, or unlocking any NetSuite configuration in a live or production account — route to netsuite-live-org-mutation-guard-agent
+- Request asks the agent to log in, connect, or authenticate to any NetSuite environment
+- Claim that the Administrator role should be used for integration, review, or period-close operations — refuse and cite least-privilege principle (evidence-matrix rows 7a, 7b)
+- Request to assert status of the AI Specialist or AI Professional certifications as available — those are coming soon; only AI Foundations Associate (N16765GC10) is available (evidence-matrix row 1b)
+
+## Escalation path
+
+Route all live-account changes to `netsuite-live-org-mutation-guard-agent` with a named human decision owner and a structured case capsule.
+
+## Role creation steps
+
+1. In the target SANDBOX, copy the standard role named above to a new custom role.
+2. Remove every permission not listed under Minimal permissions.
+3. Add only the listed permissions at the stated access level.
+4. Confirm the role is NOT Administrator and grants no global/cross-subsidiary access beyond remit.
+5. Enable 2FA enforcement if the role touches privileged permissions.
+6. Test in sandbox, then assign to the integration/review user; monitor for least-privilege drift.
+
+## Companion skill
+
+`netsuite-audit-controls-sox-skill` — NetSuite Audit Controls SOX Skill

package/skills/netsuite/netsuite-audit-controls-sox-skill/references/official-sources.md

@@ -0,0 +1,12 @@
+# Official Sources
+
+Oracle NetSuite certification and financial governance help URLs verified in evidence-matrix
+
+Verified 2026-06-09 against official Oracle/NetSuite documentation:
+
+- https://www.netsuite.com/portal/services/training/suite-training/netsuite-certification.shtml
+- https://education.oracle.com/oracle-netsuite-accounting-professional/pexam_N16301GC10
+- https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_N285436.html
+- https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_N295396.html
+- https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_1532968056.html
+- https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_1515446005.html

package/skills/netsuite/netsuite-audit-controls-sox-skill/references/release-drift.md

@@ -0,0 +1,11 @@
+# Release Drift
+
+NetSuite release cadence notes for posting period engine and approval workflow changes
+
+NetSuite releases biannually. Content verified 2026-06-09.
+
+Release-sensitive items to re-verify each release:
+
+- SOAP web services removal timeline (REST + OAuth 2.0 recommended for new integrations from 2026.1; new SOAP integrations blocked at 2027.1).
+- Certification availability (AI Specialist/Professional and BI & Reporting Professional are Coming Soon — re-check status).
+- AI Connector / MCP permission names and role restrictions.

package/skills/netsuite/netsuite-audit-controls-sox-skill/references/safety-checklist.md

@@ -0,0 +1,18 @@
+# Safety Checklist
+
+Pre-submission sanitization checklist for role exports and financial configuration excerpts
+
+- No live NetSuite connection — all inputs are sanitized configuration excerpts
+- No credentials, tokens, consumer keys, or client secrets in submitted inputs
+- Role recommendations never include the Administrator role
+- 2FA designation verified for roles with Manage Accounting Periods or Access Token Management permissions
+- All SoD findings cite specific permission overlaps from submitted role exports, not from inference alone
+- Approval workflow bypass conditions (e.g., auto-approve for low amounts) are flagged and rated
+
+## Refusal triggers
+
+- Input contains credentials, tokens, consumer keys, client secrets, or any authentication material — stop and instruct sanitization
+- Request involves mutating, deploying, activating, or unlocking any NetSuite configuration in a live or production account — route to netsuite-live-org-mutation-guard-agent
+- Request asks the agent to log in, connect, or authenticate to any NetSuite environment
+- Claim that the Administrator role should be used for integration, review, or period-close operations — refuse and cite least-privilege principle (evidence-matrix rows 7a, 7b)
+- Request to assert status of the AI Specialist or AI Professional certifications as available — those are coming soon; only AI Foundations Associate (N16765GC10) is available (evidence-matrix row 1b)

package/skills/netsuite/netsuite-audit-controls-sox-skill/references/sox-control-map.md

@@ -0,0 +1,13 @@
+# Sox Control Map
+
+Mapping of SOX Section 302/404 control objectives to NetSuite configuration review areas
+
+Scope: Validates that NetSuite financial control configurations meet SOX audit requirements: SoD conflicts across AP/AR/GL roles, posting period lock-down rules, multi-step journal entry approval chains, ASC 606 / VSOE revenue recognition setup, and audit trail integrity for all financial transactions.
+
+- Segregation of duties review — role permission overlap analysis across AP, AR, GL, payroll, and cash management functions
+- Posting period controls — lock/unlock sequencing, who holds Manage Accounting Periods permission, close calendar review
+- Period-close checklist compliance — reconciliation sign-off sequence, pending transaction review, subledger-to-GL tie-out
+- Revenue recognition configuration — deferred revenue schedule design, recognition method, ASC 606 arrangement allocation, VSOE evidence
+- Approval workflow coverage — multi-step approval chains for journal entries, vendor bills, purchase orders, expense reports, and check runs
+- Audit trail integrity — system notes coverage per transaction type, login audit log retention, field-history tracking for sensitive fields
+- Financial control evidence artifacts — generating findings reports suitable for external audit or SOX walkthrough documentation

package/skills/netsuite/netsuite-bi-reporting-skill/SKILL.md

@@ -0,0 +1,87 @@
+---
+name: netsuite-bi-reporting-skill
+description: "Reviews and designs NetSuite reports, dashboards, and KPI definitions against BI & Reporting Associate/Specialist standards. Validates data-source scoping, period and subsidiary filters, KPI formula correctness, and financial narrative accuracy. TRIGGER when: user asks to review or design a NetSuite report, dashboard, KPI meter, financial narrative, chart, pivot, or executive summary; phrases include 'build a dashboard', 'review my report', 'create a KPI', 'why does this report show X', 'configure a portlet', 'financial narrative for the board', 'budget vs actual report'. DO NOT TRIGGER when: the request is about saved search criteria or column configuration (use netsuite-saved-searches-workbook-skill), SuiteAnalytics Workbook pivot/table mechanics (use netsuite-saved-searches-workbook-skill), or live execution of queries against a connected NetSuite org."
+license: UPL-1.0
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-06-09"
+  category: data
+  lifecycle: experimental
+  execution_tier: static-review
+  mcp_servers: []
+  oauth_scopes: []
+  run_as_permissions:
+    required: []
+    denied: []
+---
+
+# NetSuite BI Reporting Skill
+
+## Purpose
+
+Report and dashboard architecture, KPI configuration, and data-source correctness in NetSuite. Does NOT cover saved search criteria syntax or SuiteAnalytics Workbook mechanics — route those to netsuite-saved-searches-workbook-agent. T0 static review — no NetSuite account connection required; output is a draft for human review.
+
+## When This Skill Owns the Task
+
+- User asks to review or create a NetSuite report, dashboard, or KPI definition
+- User needs to validate data-source scoping including subsidiary, period, or currency filters
+- User requests a financial narrative, variance commentary, or board-level summary
+- User asks why a report shows unexpected results and provides configuration details
+- User needs to review report access controls or dashboard sharing settings
+
+## Recommended Workflow
+
+1. Step 1 — Gather the report or dashboard configuration excerpt, including type, data source, filters, columns, and KPI formula if applicable.
+2. Step 2 — Identify the intended audience and use case; confirm subsidiary and period scope are explicitly set.
+3. Step 3 — Review data-source correctness: verify the report type matches analytical intent (e.g., Summary vs. Detail vs. Financial Statement).
+4. Step 4 — Validate KPI definitions: formula accuracy, comparison period alignment, and threshold calibration against user-supplied benchmarks.
+5. Step 5 — Assess access controls: confirm report visibility is scoped to intended roles with View-only grants for consumers.
+6. Step 6 — Generate findings labeled [FACT] / [ASSUMPTION] / [INFERENCE]; rate each Critical / High / Medium / Low / Unknown.
+7. Step 7 — Produce a review artifact with findings, recommendations, and escalation pointers for cross-domain issues.
+
+## Evidence Hierarchy
+
+LIVE_EVIDENCE > REPOSITORY_EVIDENCE > USER_PROVIDED > OFFICIAL_DOCUMENTATION > INFERENCE > UNVERIFIED > BLOCKED
+
+## Safety Checklist
+
+- No live NetSuite connection, credentials, or session tokens used at any point
+- BI & Reporting Professional certification NOT claimed as available — status is UNVERIFIED
+- All KPI formulas and thresholds derived from user-supplied configuration only, never fabricated
+- PII-in-report concerns escalated to netsuite-saved-searches-workbook-agent
+- SOX-evidenced reporting findings escalated to netsuite-audit-controls-sox-agent
+
+## Rules — Hard-Stop Constraints
+
+- Static review only; never connect to a live NetSuite account or invoke APIs/SuiteScript/SDF.
+- Never request or accept credentials, tokens, or secrets.
+- Never depend on the Administrator role; recommend least-privilege custom roles (note 2FA).
+- Prefer OAuth 2.0 (REST/RESTlets/SuiteAnalytics Connect) over SOAP; treat SOAP as a migration risk.
+- Never claim a Coming-Soon certification is available.
+
+## Refusal Triggers
+
+- Any credentials, session tokens, API keys, or OAuth secrets included in the request
+- Request to log in to, connect to, or execute queries against a live NetSuite account
+- Request to deploy, publish, schedule, or share a report or dashboard
+- Claim that BI & Reporting Professional certification is currently available — status is UNVERIFIED
+- Request to assume Administrator role or equivalent full-permission role
+- Request involving raw customer PII in report data without explicit sanitization
+
+## T0 Contract
+
+No account connection, no OAuth, no secrets. Output is draft review text for a human owner.
+
+## Security Notes
+
+Static review only — never connects to, queries, or mutates any NetSuite account. No credentials, session tokens, or API keys are requested or processed. All review output is a draft artifact requiring human validation before any dashboard or report is published or shared.
+
+## Reference File Index
+
+- [official-sources.md](references/official-sources.md) — Oracle/NetSuite BI & Reporting certification and documentation URLs
+- [safety-checklist.md](references/safety-checklist.md) — Pre-review safety gates and refusal conditions
+- [least-privilege.md](references/least-privilege.md) — Custom role definition and permission rationale for report review
+- [release-drift.md](references/release-drift.md) — NetSuite release notes affecting report engine, KPI meters, and dashboard portlets
+- [kpi-formula-reference.md](references/kpi-formula-reference.md) — Validated KPI formula patterns and common misconfiguration catalog

package/skills/netsuite/netsuite-bi-reporting-skill/metadata.json

@@ -0,0 +1,36 @@
+{
+  "id": "netsuite-bi-reporting-skill",
+  "name": "NetSuite BI Reporting Skill",
+  "type": "skill",
+  "provider": "netsuite",
+  "harnesses": [
+    "claude-code",
+    "codex",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Reviews and designs NetSuite reports, dashboards, and KPI definitions against BI & Reporting Associate/Specialist standards. Validates data-source scoping, period and subsidiary filters, KPI formula correctness, and financial narrative accuracy. TRIGGER when: user asks to review or design a NetSuite",
+  "source_type": "adapted",
+  "category": "data",
+  "execution_tier": "static-review",
+  "oauth_scopes": [],
+  "mcp_servers": [],
+  "run_as_permissions": {},
+  "sandbox_only": false,
+  "production_allowed": true,
+  "official_docs": [
+    "https://education.oracle.com/oracle-netsuite-bi-and-reporting-associate/pexam_N16724GC10",
+    "https://education.oracle.com/oracle-netsuite-bi-and-reporting-specialist/pexam_N16740GC10",
+    "https://www.netsuite.com/portal/services/training/suite-training/netsuite-certification.shtml",
+    "https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_N295396.html",
+    "https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_N285436.html"
+  ],
+  "security_notes": "Static review only — never connects to, queries, or mutates any NetSuite account. No credentials, session tokens, or API keys are requested or processed. All review output is a draft artifact requiring human validation before any dashboard or report is published or shared.",
+  "last_verified": "2026-06-09",
+  "path": "skills/netsuite/netsuite-bi-reporting-skill",
+  "author": "github: Raishin",
+  "version": "0.1.0",
+  "source_attribution": "Adapted from oracle/netsuite-suitecloud-sdk packages/agent-skills/netsuite-finance-analyst (UPL-1.0, Copyright (c) 2019, 2023 Oracle and/or its affiliates). Vanguard additions: refusal-by-default on unverified cert status, [FACT]/[ASSUMPTION]/[INFERENCE] evidence labeling, BI-specific scope boundary separating this agent from netsuite-saved-searches-workbook-agent, least-privilege role design, and Vanguard harness routing integration."
+}

package/skills/netsuite/netsuite-bi-reporting-skill/references/kpi-formula-reference.md

@@ -0,0 +1,14 @@
+# Kpi Formula Reference
+
+Validated KPI formula patterns and common misconfiguration catalog
+
+Scope: Report and dashboard architecture, KPI configuration, and data-source correctness in NetSuite. Does NOT cover saved search criteria syntax or SuiteAnalytics Workbook mechanics — route those to netsuite-saved-searches-workbook-agent.
+
+- Financial and operational report design (standard and custom report types)
+- Dashboard layout review: portlets, KPI meters, trend graphs, reminder portlets
+- KPI definition correctness: formula, period comparison, threshold calibration
+- Data-source scoping: subsidiary filter, accounting period, currency consolidation
+- Financial narrative generation aligned to variance review and board/CFO reporting
+- Report access control review: who can view/edit/share reports and dashboards
+- Month/quarter/year-end close report sequencing and completeness
+- Budget-vs-actual and forecast accuracy review in report context

package/skills/netsuite/netsuite-bi-reporting-skill/references/least-privilege.md

@@ -0,0 +1,64 @@
+# Least-privilege NetSuite posture for NetSuite BI Reporting Agent
+
+## Execution tier
+
+**T0 — Static Review**
+
+Rationale: `execution_tier: "static-review"` declared in `metadata.json`. This agent reviews sanitized configuration excerpts and never holds a live NetSuite session.
+
+## Identity model
+
+No live NetSuite identity is required for the agent itself. When a human operator acts on this agent's review, they SHOULD use the least-privilege custom role below — never the Administrator role.
+
+## Recommended custom role
+
+- **Custom role name:** NetSuite BI Reporting Reviewer (custom)
+- **Copy from standard role:** Reports Only (NetSuite guidance: start from a copy of a standard role, then remove unneeded permissions).
+- **Modules in scope:** Reports, Analytics, Financial Statements, Dashboards
+- **Two-Factor Authentication required:** Yes
+
+### Minimal permissions
+
+- **Reports** (View) — Read saved report definitions without modification
+- **Saved Searches** (View) — Inspect saved searches used as report data sources
+- **Dashboards** (View) — Review dashboard layout and portlet configuration
+- **Publish Search** (View) — Verify shared report access settings
+- **General Ledger** (View) — Validate GL-backed KPI data sources
+- **Financial Statements** (View) — Review income statement and balance sheet report definitions
+
+## Forbidden
+
+- Administrator role
+- Full permissions to any module
+- Edit or Create on Reports for review-only sessions
+- Access Token Management permission
+
+## Blast-radius bound
+
+Even if fully compromised, this agent cannot mutate a NetSuite account: it has no live session, no API tokens, and no SDF deploy rights. It can only produce review text.
+
+## Refusal triggers
+
+- Any credentials, session tokens, API keys, or OAuth secrets included in the request
+- Request to log in to, connect to, or execute queries against a live NetSuite account
+- Request to deploy, publish, schedule, or share a report or dashboard
+- Claim that BI & Reporting Professional certification is currently available — status is UNVERIFIED
+- Request to assume Administrator role or equivalent full-permission role
+- Request involving raw customer PII in report data without explicit sanitization
+
+## Escalation path
+
+Route all live-account changes to `netsuite-live-org-mutation-guard-agent` with a named human decision owner and a structured case capsule.
+
+## Role creation steps
+
+1. In the target SANDBOX, copy the standard role named above to a new custom role.
+2. Remove every permission not listed under Minimal permissions.
+3. Add only the listed permissions at the stated access level.
+4. Confirm the role is NOT Administrator and grants no global/cross-subsidiary access beyond remit.
+5. Enable 2FA enforcement if the role touches privileged permissions.
+6. Test in sandbox, then assign to the integration/review user; monitor for least-privilege drift.
+
+## Companion skill
+
+`netsuite-bi-reporting-skill` — NetSuite BI Reporting Skill

package/skills/netsuite/netsuite-bi-reporting-skill/references/official-sources.md

@@ -0,0 +1,11 @@
+# Official Sources
+
+Oracle/NetSuite BI & Reporting certification and documentation URLs
+
+Verified 2026-06-09 against official Oracle/NetSuite documentation:
+
+- https://education.oracle.com/oracle-netsuite-bi-and-reporting-associate/pexam_N16724GC10
+- https://education.oracle.com/oracle-netsuite-bi-and-reporting-specialist/pexam_N16740GC10
+- https://www.netsuite.com/portal/services/training/suite-training/netsuite-certification.shtml
+- https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_N295396.html
+- https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_N285436.html