Grammarly Access Readiness

Audit an operator-supplied OAuth metadata document without contacting Grammarly and without handling a credential. The audit is a readiness gate, not an OAuth client or an authorization oracle.

Overview

The skill separates documented API scope requirements from account eligibility and reports a deterministic READY or BLOCKED result. It is deliberately useful in an offline review or CI check where live credentials and network access are forbidden.

When to use

Use this skill for a planned integration, scope review, or access review involving the Grammarly Writing Score API, Analytics API, License Management API, AI Detection API (Beta), or Plagiarism Detection API (Beta). Do not trigger for generic OAuth questions, unrelated Grammarly application use, or a request to retrieve or rotate secrets.

Prerequisites

• A synthetic metadata-only JSON object matching references/oauth-scope-contract.md.
• An out-of-band administrator confirmation of the Enterprise or institution-wide Education license; do not put that confirmation's identifier in the JSON.
• Python 3.10 or newer. No Grammarly credential, network access, or writable output directory is required.

Instructions

1. Ask for the metadata-only JSON shape in references/oauth-scope-contract.md. Never ask for a client secret, access token, refresh token, authorization header, or pasted API response.
2. Run the deterministic guard with stdin:

   python3 scripts/audit_oauth_config.py < oauth-config.json

1. Treat BLOCKED as a stop. Resolve the named metadata issue and rerun; do not broaden scopes merely to make the result pass.
2. Treat READY as an offline configuration result only. An administrator still has to create the OAuth credential and approve the production change through the organization's normal process.

The script uses its own closed-world operation map and exact scope strings; callers cannot redefine the official catalog. It recognizes only enterprise or education-institution-wide access, requires an approved configuration-source class, and recursively rejects secret-bearing keys and values. AI Detection and Plagiarism always carry the official catalog discrepancy flag and require an explicit authorized exception decision; that decision does not prove beta provisioning.

Output

Return the script's JSON decision, the missing or excessive scope names, the required scopes, and any official-catalog flag. Do not repeat input values other than non-sensitive operation and scope names. Never print a credential or claim that the OAuth configuration was tested live.

Error Han…

Grammarly API Reliability

This is a read-only, metadata-only decision aid for asynchronous Grammarly jobs. It does not call Grammarly, upload text, inspect a response body, create a token, or retry a request. It turns one strict JSON receipt into a bounded, evidence-labeled classification.

Overview

Use this skill to classify a sanitized asynchronous receipt without treating a provider response as permission to retry blindly.

Prerequisites

No credentials, network access, Grammarly account, document, or response body is needed. Python 3.10+ is the only runtime requirement. If a separate live integration is being designed, use the official OAuth 2.0 credentials documentation (accessed 2026-09-04) to determine access; live authentication and requests are outside this skill.

Instructions

Step 1: Run the deterministic analyzer

Run the bundled script against a receipt file or standard input:

python3 scripts/analyze_job_receipt.py receipt.json
cat receipt.json | python3 scripts/analyze_job_receipt.py -
python3 scripts/analyze_job_receipt.py --self-test

The analyzer accepts only the documented metadata schema in references/receipt-schema.md. It recursively rejects keys associated with document content, bodies, text, headers, or tokens, including those hidden in an otherwise unknown nested object. Unknown keys, malformed values, inconsistent 429 evidence, and attempts above the cap fail closed.

Step 2: Apply the decision rules

• COMPLETED is terminal. Do not retry it.
• PENDING is not a failure. Report that the receipt is still pending; do not invent a polling interval, timeout, SLA, quota, or freshness guarantee.
• FAILED with http_status: 429 is the only status-specific retry class in this skill. If a numeric retry_after_seconds value is supplied, the output preserves that evidence as the wait instruction. If it is absent, the output names Grammarly's documented 2-second-base exponential-backoff guidance for 429 only; it does not invent a maximum, jitter rule, quota, or service promise.
• Any failure without 429 evidence is MANUAL_REVIEW: the receipt alone does not establish that retrying is safe.
• A failed receipt at attempts == max_attempts is ATTEMPT_CAP_REACHED and must not receive retry guidance. An input with attempts > max_attempts is invalid.

The cap is caller-supplied policy, not a Grammarly limit. The analyzer never changes the cap or performs the next attempt. A human or caller-owned controller must decide whether a retry is appropriate after reviewing the emitted classification.

Step 3: Enforce the safety …

Grammarly Data Safety Guardian

Run a deterministic preflight over a metadata-only submission manifest. The guard answers whether a planned document upload satisfies this skill's hard safety gates; it does not read a document, contact Grammarly, create an upload URL, or retain a copy of the manifest.

Overview

The guard is a closed-world policy check for a planned document submission. It combines Grammarly's documented format and size constraints with local governance decisions while keeping the document itself outside the workflow.

When to use

Use for a Writing Score, AI Detection (Beta), or Plagiarism Detection (Beta) document submission before and after the evaluator inspects the provider-issued upload origin. The preliminary decision gates OAuth metadata disclosure; the final decision gates document bytes. Do not trigger for writing or editing content, document previews, credential troubleshooting, or a request to upload a real document.

Prerequisites

• A synthetic or production-approved metadata-only manifest matching references/submission-contract.md.
• Independent data-owner approval, consent evidence, transfer approval, content classification, and acknowledgment of provider retention boundaries.
• Python 3.10 or newer. No document path, document content, credential, network, or writable output directory is required.

Instructions

1. Collect only the manifest described in references/submission-contract.md. The manifest may contain extension, byte count, optional derived text counts, and governance decisions, the pinned API control-plane origin, and the exact sanitized presigned upload origin; it must not contain text, content, previews, credentials, paths, filenames, full upload URLs, or raw API responses.
2. Run the guard with stdin:

   python3 scripts/audit_submission_manifest.py < submission-manifest.json

1. Treat BLOCKED as a hard stop. Fix the named metadata or governance decision; never truncate or transform a document silently to pass the guard.
2. Treat INSPECTION_READY as permission only to create a normalized-filename job and inspect its sanitized upload origin. Treat READY as permission to continue to the separately authorized upload workflow, not as proof that a document is lawful, accurate, or safe for a new destination.

The script accepts strict JSON, rejects duplicate keys and non-standard constants, recursively rejects raw text, location, response, and credential fields, and performs no network or filesystem writes. It enforces the documented extensions, 4,194,304-byte maximum, UTF-8 text counts, a non-restricted classification, all approval gates, the exact https://api.grammarly…

Grammarly Document Evaluator

Overview

Run Grammarly's three documented document APIs without inventing a direct-text endpoint. The helper is dry-run by default. Before upload, it can create a metadata-only request that reveals only the sanitized presigned origin for approval. Inspection requires an INSPECTION_READY manifest before OAuth. Live execution requires an exact digest and a READY closed-schema safety manifest bound to the operation, bytes, and both destinations. It reads OAuth credentials only from the process environment, bounds polling locally, and emits no token, full upload URL, raw request identifier, or document text.

Prerequisites

• Grammarly Enterprise or an institution-wide Grammarly for Education license with API access.
• Python 3.10 or newer.
• One supported regular, non-symlink file: .doc, .docx, .odt, .txt, or .rtf.
• For live execution only, GRAMMARLY_CLIENT_ID and GRAMMARLY_CLIENT_SECRET in the environment.
• The exact read/write scopes for the selected operation; see API contract.

Instructions

1. Classify the operation as writing-score, ai-detection, or plagiarism.
2. Run the helper without --execute from this skill directory:

   python3 scripts/run_document_evaluation.py \
     --operation writing-score \
     --file /approved/input/document.txt

1. Review the endpoint, scopes, beta marker, local constraints, retention boundary, and content_sha256. A dry run does not contact Grammarly.
2. Create a preliminary manifest with presigned_upload_origin: null and presigned_upload_origin_approved: false. Continue only when the safety guardian returns INSPECTION_READY, then inspect the actual byte destination. This creates a provider request but performs no upload and emits no signed URL:

   python3 scripts/run_document_evaluation.py \
     --operation writing-score \
     --file /approved/input/document.txt \
     --inspect-upload-origin \
     --confirm-content-sha256 sha256:REVIEWED_DIGEST \
     --approval-manifest /approved/metadata/grammarly-inspection.json

1. Put that exact sanitized origin and the dry-run metadata into the closed manifest for grammarly-data-safety-guardian. Continue only when it returns READY.
2. If live transfer is authorized, execute with both bindings:

   python3 scripts/run_document_evaluation.py \
     --operation writing-score \
     --file /approved/input/document.txt \
     --execute \
     --confirm-content-sha256 sha256:REVIEWED_DIGEST \
  …

Grammarly License Governor

This skill creates a human-review queue from a sanitized License Management API snapshot. It never calls Grammarly, resolves identities, sends a mutation, or deletes a user or invitee. A candidate is only a non-admin user whose recorded last_activity_at is strictly earlier than the explicit inactive_before cutoff.

Overview

Use this skill for a bounded seat-review decision from sanitized user activity metadata, not for identity resolution or live account administration.

Prerequisites

No credentials, network access, Grammarly account, names, email addresses, or raw IDs are needed. Python 3.10+ is the only runtime requirement. If a separate live integration is being designed, consult the official OAuth 2.0 credentials documentation (accessed 2026-09-04) for scopes; live authentication and mutation are outside this skill.

Instructions

Step 1: Run the analyzer

python3 scripts/analyze_license_snapshot.py snapshot.json
cat snapshot.json | python3 scripts/analyze_license_snapshot.py -
python3 scripts/analyze_license_snapshot.py --self-test

The input contract is intentionally narrow. It accepts one snapshot object with an explicit snapshot timestamp and UTC cutoff, producer attestation for keyed HMAC-SHA256 pseudonymization, and records containing only resource pseudonyms, last-activity timestamps, and the admin flag. Names, email addresses, raw numeric/string IDs, institution identifiers, secrets, tokens, headers, and unknown fields fail closed, including when nested.

Step 2: Apply the review rules

• Require snapshot_generated_at and inactive_before; never use the current time or an implicit default, and reject a cutoff later than the snapshot.
• Compare timestamps in UTC and classify only last_activity_at < inactive_before. Equal timestamps are not inactive-before evidence.
• Exclude every record with is_admin: true. The official API says admin licenses cannot currently be removed; admins must not enter the candidate plan.
• Require the exact producer-attestation object and keep candidate identity to resource_id_hmac_sha256, generated outside this tool with an organization-controlled HMAC key. The analyzer validates attestation and digest shape but cannot cryptographically prove upstream generation. Do not reverse, join, enrich, or display identity attributes; a plain unsalted hash is not enough.
• Emit HUMAN_REVIEW_ONLY candidates. The output is not an execution manifest and contains no delete operation, endpoint call, or authorization instruction.
• Missing activity evidence, duplicate digests, malformed timestamps, and raw or identity-bearing fields are review blockers, not re…