Source-backed rules for AI workflow directories that need to classify commercial, sponsored, affiliate, vendor-authored, and thin promotional submissions before they enter the ordinary editorial content queue.
Open the source and read safety notes before installing.
Source-backed facts for citing this resource, derived directly from the registry — also available as plain text for AI assistants.
Decision playbook
Signals are present but mixed. Use the checklist below to confirm the source and operational safety for your environment.
0
78
—
No baseline selected
No major trust-signal divergence detected in the current selection.
Confirm ownership and provenance before trusting install instructions.
Source link availableRequired
Open the canonical repository and verify ownership.
Source provenance statusRequired
Marked as source-backed.
Metadata reviewed
Registry metadata indicates a reviewed listing.
Validate risk disclosures before installation or API wiring.
Safety notes presentRequired
Review the listed safety guidance before running commands.
Privacy notes presentRequired
Review data handling notes before connecting accounts or secrets.
Trust level risk gateRequired
Trust level does not block evaluation.
Check package metadata and artifact integrity signals.
Install payload available
Install or copy payload is available for review.
Package verification flag
No package verification flag provided.
Checksum metadata
No checksum provided for downloaded artifact.
Use compare context to validate trade-offs before adoption.
Compare tray has multiple entries
Add at least one more entry to compare trust differences.
Baseline comparison available
No baseline peer selected yet.
Diverging trust signals identified
No major trust-signal divergence found.
Setup at a glance
Copy-ready — paste the snippet to get started.
Adoption plan
Current risk score 16/100. Use staged verification before broader rollout.
Validate source and review signals before any execution.
Confirm source provenanceRequired
Source URL/provenance metadata is present.
Confirm metadata review state
Listing has review metadata.
Verify install payload
Install/config payload exists and can be inspected.
Confirm safety, privacy, and package integrity signals.
Review safety notesRequired
Safety notes are present.
Review privacy notesRequired
Privacy notes are present.
Verify package integrity metadata
No package verification/checksum metadata.
Adopt in controlled steps based on the selected plan.
Run in isolated sandbox firstRequired
Use a constrained sandbox and observe behavior across multiple tasks.
Roll out graduallyRequired
Roll out to a small cohort before wider usage.
Set monitoring and fallback
Define rollback path and monitor errors after adoption.
Evidence readiness
Required evidence gates are covered (5/6 signals complete).
Source repository/provenance is listed.
Required in this preset
Review metadata is present.
Required in this preset
Safety notes are present.
Required in this preset
Privacy notes are present.
Optional in this preset
Package integrity metadata is missing.
Optional in this preset
Install payload is available.
Required in this preset
Required evidence gates are covered for this preset.
Decision timeline
5/6 steps complete with no blocking gaps for this preset.
triage
Source/provenance metadata is available.
triage
Review metadata is available.
verify
Safety notes are available.
verify
Privacy notes are available.
verify
Package integrity metadata is missing.
rollout
Install payload is available.
No required blockers for this timeline preset.
Prerequisite readiness
4 prerequisites to line up before setup. Includes a review or approval gate.
Safety & privacy surface
3 safety and 3 privacy notes across 4 risk areas. Review closely: third-party handling.
You are reviewing a commercial or promotional submission for an AI workflow
directory.
Rules:
1. Classify the submitter relationship before judging quality.
2. Route paid, sponsored, affiliate, claimed, or vendor-authored submissions to
maintainer-owned commercial review instead of ordinary editorial review.
3. Reject affiliate or referral URLs in free contributor content.
4. Require clear disclosure when a listing is sponsored, affiliate-backed,
vendor-authored, or commercially claimed.
5. Keep editorial listings source-backed, comparative, and non-promotional.
6. Do not merge thin product copy, unsupported superlatives, or tracking links.Use these rules when an AI workflow directory receives a submission that might be commercial, sponsored, affiliate-backed, vendor-authored, vendor-claimed, or promotional. The goal is to keep ordinary editorial content review separate from commercial placement and to make disclosure decisions before copy quality is debated.
These rules do not decide whether a product is good. They decide which review path a submission belongs in and what evidence must exist before it can appear in a public directory.
Classify the submission before editing prose.
When the classification is unclear, route the submission to maintainer review. Do not merge it as ordinary editorial content while the relationship is unknown.
Ordinary editorial content should describe verifiable utility rather than sell.
Accept content that:
Request changes or reject content that:
Commercial status should be visible to reviewers and users.
Disclosure does not rescue thin content. A sponsored or vendor-authored entry still needs source evidence, safety notes, privacy notes, and directory-specific editorial value.
Checked existing rules, guides, collections, tools, MCP entries, statuslines, submission validators, and recent PRs for commercial routing rules, sponsored directory submissions, affiliate link rejection, vendor-authored content, promotional copy review, and disclosure policy.
Existing entries often include per-listing disclosure text such as "no paid placement or affiliate link is used," and the submission pipeline rejects affiliate/referral URLs. This rules entry is distinct because it gives portable do/don't behavior for deciding whether a directory submission belongs in ordinary editorial review, maintainer-owned commercial review, or rejection.
Google Search Central documents the spam policies below. Each names a pattern that commercial and promotional directory submissions commonly trigger, which is why routing happens before quality review. Definitions are quoted from Google's spam policies page.
| Google spam policy | What Google says it covers (verbatim) |
|---|---|
| Thin affiliation | "the practice of publishing content with product affiliate links where the product descriptions and reviews are copied directly from the original merchant without any original content or added value." |
| Link spam | "the practice of creating links to or from a site primarily for the purpose of manipulating search rankings." |
| Scaled content abuse | "when many pages are generated for the primary purpose of manipulating search rankings and not helping users." |
| Scraping | "the practice of taking content from other sites, often through automated means, and hosting it with the purpose of manipulating search rankings." |
| Site reputation abuse | "a tactic where third-party content is published on a host site mainly because of that host's already-established ranking signals." |
| User-generated spam | "spammy content added to a site by users through a channel intended for user content." |
| Misleading functionality | "intentionally creating sites that trick users into thinking they would be able to access some content or services but in reality can't." |
Show that Commercial Content Routing Rules is listed on HeyClaude. Paste this Markdown into your README — it renders the badge and links back to this page.
[](https://heyclau.de/entry/rules/commercial-content-routing-rules)Commercial Content Routing Rules side by side with 2 alternatives on trust, install, platform support, and disclosed safety notes — all from reviewed registry metadata.
1 trust signal differ across this comparison (Submitter).
| Field | Source-backed rules for AI workflow directories that need to classify commercial, sponsored, affiliate, vendor-authored, and thin promotional submissions before they enter the ordinary editorial content queue. Open dossier | Source-backed rules for reviewing AI-generated code that renders untrusted data into HTML, JavaScript, URLs, or CSS before merge for cross-site scripting risk, covering context-correct output encoding, dangerous DOM sinks, HTML sanitization, and Content-Security-Policy as defense in depth. Open dossier | Source-backed rules for AI workflow directories that need consistent privacy metadata before accepting entries that touch prompts, files, local tools, hosted services, telemetry, generated artifacts, or personal data. Open dossier |
|---|---|---|---|
| Next steps | |||
| Trust | |||
| Review status | ReviewedMaintainer reviewed | ReviewedMaintainer reviewed | ReviewedMaintainer reviewed |
| Package trust | Package not verified | Package not verified | Package not verified |
| Source provenance | Source-backed | Source-backed | Source-backed |
| SubmitterDiffers | MkDev11 | lourincedaging0-commits | MkDev11 |
| Install risk | Review first | Review first | Review first |
| Notes | Safety ✓ Privacy ✓ | Safety ✓ Privacy ✓ | Safety ✓ Privacy ✓ |
| Brand | — | — | — |
| Category | rules | rules | rules |
| Source | Source-backed | Source-backed | Source-backed |
| Author | MkDev11 | lourincedaging0-commits | MkDev11 |
| Added | 2026-06-04 | 2026-07-15 | 2026-06-04 |
| Platforms | |||
| Harness | |||
| Source repo | — | — | — |
| Safety notes | ✓Commercial routing is an editorial control, not a legal compliance guarantee; escalate uncertain sponsorship, endorsement, or advertising questions to the maintainer or counsel. Do not let generated copy invent rankings, endorsements, security claims, customer counts, pricing promises, or benchmark results. Treat paid placement, affiliate links, vendor claims, and product submissions as higher-review-risk even when the linked product is technically useful. | ✓A successful XSS injection runs attacker JavaScript in another user's browser session, enabling session/token theft, account takeover, keylogging, or unauthorized actions performed as that user. AI assistants frequently reach for innerHTML, dangerouslySetInnerHTML, or string-concatenated HTML because it is the shortest path to the desired rendering, without adding sanitization or switching to a safe sink. Relying only on a Content-Security-Policy header is not sufficient: CSP support and enforcement vary by browser, misconfiguration is common, and it does not address DOM-based XSS that never touches the network. | ✓Privacy metadata is a reviewer aid, not proof that a workflow is safe or compliant for every jurisdiction or organization. Escalate entries that touch regulated data, customer records, credentials, browser state, production systems, or private repositories. Do not let generated descriptions replace source-backed privacy notes; require the submitter to identify actual data paths. |
| Privacy notes | ✓Commercial submissions may include submitter identity, company relationship, pricing terms, sales contacts, invite links, private roadmap claims, or analytics parameters. Remove tracking parameters and do not expose private sponsorship negotiations, vendor emails, account IDs, coupon codes, or referral IDs in public review threads. Keep reviewer notes focused on observable source evidence and directory policy rather than private commercial discussions. | ✓XSS proof-of-concept payloads and captured DOM/session state can include real session tokens, cookies, or personal data; use synthetic accounts and redact captures before pasting them into a PR or issue. Sanitizer configuration (allowed tags/attributes) can itself leak intent about what user-generated content the product stores; avoid documenting real user content samples in public review threads. Third-party scripts and widgets execute with the same DOM access as first-party code; disclose any new third-party script include as part of the change under review. | ✓The review itself can expose private repo names, tool config, prompt examples, customer-like fixtures, logs, screenshots, or vendor account details. Avoid copying secrets, private prompts, personal data, or proprietary datasets into public metadata examples. Record unknowns honestly instead of filling gaps with guessed retention, sharing, or telemetry behavior. |
| Prerequisites |
|
|
|
| Install | — | — | — |
| Config | — | — | — |
| Citations | |||
| Claim | Unclaimed | Unclaimed | Unclaimed |
Loading live community signals…
A short, calm digest of reviewed Claude resources. Unsubscribe any time.