Agent skill · security · jeremylongshore
algolia-security-basics
Audit and harden Algolia credentials, record exposure, index restrictions, and tenant search controls. Use when reviewing frontend keys, backend ACLs, key rotation, or data visibility. Trigger with "secure Algolia", "Algolia key audit", or "Algolia security review".
Why this skill is useful
Provides specific Algolia API key management procedures and security practices that the AI wouldn't reliably generate on its own.
What it needs
Requires algolia account access. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Algolia Security Baseline Overview This skill reviews the actual security boundary of an Algolia integration. A browser search-only key is intentionally visible, so record contents, index restrictions, secured-key design, and abuse controls remain essential. Prerequisites A named repository, environment, and Algolia application or index in scope The local lockfile and installed client types as implementation authority A safe read-only query or explicitly disposable test target Current first-party documentation for any provider behavior that affects the change Tool Discipline Use Read, Glob, and Grep to inspect local code, configuration names, tests, and dependency versions. Use WebFetch only for current official Algolia documentation. Use Write or Edit only after identifying the target files, constraints, and verification plan. Current Contract Never index data that must remain secret merely because an attribute is not displayed. Use custom main keys with minimum ACLs and restrictions; rotate long-lived keys under an owned policy. Generate secured keys on a trusted backend and require restrictions appropriate to the user or tenant. Treat referer restrictions, rate limits, filters, and ACLs as layers whose current behavior must be verified. Authentication Inspect key metadata without exporting secret values. Admin credentials stay out of application defaults, browser bundles, logs, support artifacts, and developer examples. Instructions 1. Inventory every application ID, environment variable, client constructor, key owner, ACL, restriction, and exposed index. 2. Scan source, built assets, history, logs, and documentation for write-capable key exposure. 3. Review record fields and index settings for data a search-only client could retrieve or scrape. 4. Map backend operations to custom key ACLs and tenant search to secured-key restrictions. 5. Test allowed and denied paths, including cross-index and cross-tenant attempts. 6. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/algolia-security-basics