Agent skill · security · jeremylongshore
adobe-security-basics
Establish least privilege, credential rotation, webhook authenticity, signed-URL custody, log minimization, and destructive-action controls. Use when designing or hardening Adobe integrations. Trigger with "secure Adobe integration", "rotate Adobe secret", or "verify Adobe webhook".
Why this skill is useful
Provides specific Adobe security practices for OAuth credential management and webhook validation that the AI wouldn't reliably generate on its own.
What it needs
Requires adobe account access. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Adobe Integration Security Baseline Overview Establish least privilege, credential rotation, webhook authenticity, signed-URL custody, log minimization, and destructive-action controls. This workflow produces a reviewable artifact and evidence before any live side effect. Prerequisites Current first-party Adobe documentation for every selected service, API version, auth flow, limit, and lifecycle. Named product, identity, security, data, budget, release, and operations owners appropriate to the scope. Synthetic or approved non-production fixtures with secret and content canaries. Current Contract Effective authority combines credential type, organization/project/workspace, scopes, product profiles, service entitlement, resource ownership, and operation. Event authenticity requires recipient and signature validation or mTLS; a syntactically valid JSON body is not trusted. Recheck the dated evidence map before relying on mutable product behavior. Authentication Store secrets server-side, redact signed URLs as bearer capabilities, rotate by overlap-and-verify, and delete the old secret only after last-use evidence proves cutover. Instructions 1. Inventory credentials, users, scopes, profiles, projects, workspaces, webhooks, storage URLs, logs, and data flows. 2. Map effective read/write/generate/deploy/admin authority and remove stale or duplicate grants. 3. Add server-side secret storage, rotation alarms, host allowlists, request schemas, and structured redaction. 4. Validate webhook recipientclientid and digital signature/public-key host, or document the approved mTLS alternative. 5. Test credential theft, wrong organization, cross-environment swap, replay, forged key URL, and log canaries. 6. Assign recertification, rotation, incident, retention, deletion, and exception owners. Tool Discipline Use Read, Glob, and Grep to inspect current documentation, configuration, code, fixtures, and evidence. Use Write and Edit only for approved repository artifacts. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/adobe-security-basics