docs: replace firm-specific identifiers with vendor-neutral placeholders

- skills/single-file-dashboard/SKILL.md: replace firm-branded
  "executive deliverable" framing with neutral "executive-style"
  language in the description, design-system section header, donut-
  chart anti-pattern note, and attribution paragraph
- skills/codebase-security-audit/{SKILL.md, references/semgrep-
  custom-rules.md}: rename the example internal HTTP client from
  a firm-specific prefix to acme_http (standard placeholder); covers
  all six rule snippets and the SKILL.md callout
- rules/400-cloudflare.mdc: replace a firm-branded IdP example
  with the more generic trio "Okta, Entra ID, Google Workspace"
  in the Cloudflare Access layer table

The repo is open-source / vendor-neutral; firm-specific identifiers
do not belong in shipped rules and skills. Verified clean with
ripgrep against firm-name and firm-prefix patterns.

[Amended after the original commit message used a specific firm
name; rewritten to keep this repo vendor-neutral end to end.]

Author: d-padmanabhan

rules/400-cloudflare.mdc

@@ -75,7 +75,7 @@ Cloudflare offers three identity surfaces in front of an origin. Use each for wh
 
 | Layer | What it answers | Identity source |
 |---|---|---|
-| **Cloudflare Access** | "Should this request reach the origin at all?" | IdP (Okta, McKinsey ID, etc.) for users; service auth tokens or mTLS for machines |
+| **Cloudflare Access** | "Should this request reach the origin at all?" | IdP (Okta, Entra ID, Google Workspace, etc.) for users; service auth tokens or mTLS for machines |
 | **Authenticated Origin Pulls (AOP)** | "Did this request actually come from Cloudflare?" | mTLS cert from Cloudflare to the origin |
 | **Worker JWT validation** | "Does this specific API call have the right scope/audience/tenant?" | The same Access JWT (`Cf-Access-Jwt-Assertion`) or a separate token |
 | **Origin JWT validation** | "Same as above, but enforced at the origin" | Same |

skills/codebase-security-audit/SKILL.md

@@ -349,7 +349,7 @@ Examples to author for any non-trivial repo:
 
 1. **Internal auth decorator missing** - every handler in `routes/` must have `@require_auth(scope=...)` or `@public_endpoint`.
 2. **PII fields without redaction** - any logger call with a known PII field name (`email`, `ssn`, `phone`, `dob`, `card_number`) must wrap it in `redact()`.
-3. **Internal SDK misuse** - internal HTTP client `mck_http.get()` must always pass `timeout=` and `verify=True`.
+3. **Internal SDK misuse** - internal HTTP client `acme_http.get()` must always pass `timeout=` and `verify=True`.
 4. **Forbidden imports** - block `import requests` in modules that should use the internal client; block `import pickle` in services that accept external input.
 5. **Tenant-scope check** - every DB query in a multi-tenant service must include a `tenant_id` filter.
 

skills/codebase-security-audit/references/semgrep-custom-rules.md

@@ -59,24 +59,24 @@ rules:
 
 ## Internal SDK misuse
 
-The internal HTTP client `mck_http.get()` must always pass `timeout=` and `verify=True`.
+The internal HTTP client `acme_http.get()` must always pass `timeout=` and `verify=True`.
 
 ```yaml
 # .semgrep/internal-http-client-misuse.yaml
 rules:
   - id: internal-http-missing-timeout
-    message: mck_http.$METHOD called without timeout
+    message: acme_http.$METHOD called without timeout
     severity: ERROR
     languages: [python]
     patterns:
-      - pattern: mck_http.$METHOD(...)
-      - pattern-not: mck_http.$METHOD(..., timeout=$T, ...)
+      - pattern: acme_http.$METHOD(...)
+      - pattern-not: acme_http.$METHOD(..., timeout=$T, ...)
 
   - id: internal-http-verify-disabled
-    message: mck_http.$METHOD called with verify=False
+    message: acme_http.$METHOD called with verify=False
     severity: ERROR
     languages: [python]
-    pattern: mck_http.$METHOD(..., verify=False, ...)
+    pattern: acme_http.$METHOD(..., verify=False, ...)
 ```
 
 ---
@@ -89,7 +89,7 @@ Block `import requests` in modules that should use the internal client; block `i
 # .semgrep/forbidden-imports.yaml
 rules:
   - id: prefer-internal-http-client
-    message: Use mck_http instead of requests
+    message: Use acme_http instead of requests
     severity: ERROR
     languages: [python]
     paths:

skills/single-file-dashboard/SKILL.md

@@ -22,7 +22,7 @@ Use when the user asks for:
 - "Build a dashboard" / "interactive HTML report" / "shareable analysis"
 - "Offline dashboard" / "airgap-safe" / "for the client" / "for the regulator"
 - "Visualize this workbook" / "turn this CSV into a presentable view"
-- A McKinsey-style executive deliverable
+- An executive-style deliverable for client / leadership / regulator review
 - Anything that must render without internet access
 
 Do *not* use for:
@@ -113,7 +113,7 @@ The build script is the source of truth. The HTML is the artifact.
 
 ---
 
-## Design system (McKinsey-style executive palette)
+## Design system (executive palette)
 
 A consistent design system makes outputs presentable without manual adjustment.
 
@@ -347,7 +347,7 @@ The script writes a single string to disk. Test it by opening the output in a br
 4. **Charting library** (D3, Chart.js, ECharts, Plotly). Each adds 100-500KB and requires either a bundler or a CDN. Vanilla SVG is enough for executive charts.
 5. **Generated HTML edited in place.** Make changes in the generator and re-run; otherwise the artifact and the source diverge.
 6. **No HTML escaping.** A user-supplied product name with `<script>` in it becomes XSS in the dashboard.
-7. **Donut / 3D / sunburst charts.** Hard to read; not McKinsey style. Use bar charts.
+7. **Donut / 3D / sunburst charts.** Hard to read at executive density. Use bar charts.
 8. **More than 3 charts in a single section.** Cognitive load over signal.
 9. **Localizing into the HTML** ("English en", "French fr") - use one language per output; multiple outputs for multiple languages.
 
@@ -388,4 +388,4 @@ The script writes a single string to disk. Test it by opening the output in a br
 
 ## Attribution
 
-Pattern crystallized from a McKinsey-style consolidation dashboard generator that produces single-file HTML output (no CDN, no fonts, no images, inline vanilla SVG) sized at <2 MB and renders identically in Chrome, Outlook, and on an airgapped laptop. The single-file/zero-dependency guarantee is the feature.
+Pattern crystallized from an executive-style consolidation dashboard generator that produces single-file HTML output (no CDN, no fonts, no images, inline vanilla SVG) sized at <2 MB and renders identically in Chrome, Outlook, and on an airgapped laptop. The single-file/zero-dependency guarantee is the feature.