Agent skill · security · jeremylongshore
anth-security-basics
Apply Anthropic Claude API security best practices for key management,
Why this skill is useful
Provides specific security practices and scripts for managing Claude API keys and preventing prompt injection that are not widely known.
What it needs
Requires anthropic account access. About 4k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Anthropic Security Basics Overview Security practices for Claude API integrations: API key management, input sanitization, prompt injection defense, and output validation. API Key Security Environment-Based Key Management Key Rotation Procedure Workspace Key Isolation Use Anthropic Workspaces to isolate keys per team/environment: Workspace Purpose Key Prefix ----------- --------- ------------ dev Development/testing sk-ant-api03-dev-... staging Pre-production sk-ant-api03-stg-... production Live traffic sk-ant-api03-prd-... Prompt Injection Defense Input Validation Output Safety Security Checklist [ ] API keys in environment variables, never in code [ ] .env in .gitignore [ ] Separate keys per environment (dev/staging/prod) [ ] Key rotation schedule (quarterly recommended) [ ] System prompts in system parameter, not user messages [ ] User input validated and length-limited [ ] Output scanned for sensitive data leakage [ ] HTTPS enforced for all API calls (SDK default) [ ] Rate limiting on your application layer [ ] Audit logging for all Claude API calls Prerequisites Use a secret manager, separate least-privilege keys/workspaces for development, staging, and production, and an owner-approved rotation and revocation procedure. Define input/output data classes, allowed models and destinations, retention/deletion windows, and a sandbox fixture set containing synthetic secrets and prompt-injection attempts. Ensure logs and traces can redact authorization headers, prompts, completions, tool inputs, PII, and key-like strings before collection. Instructions 1. Load the key only at process startup from the approved secret provider; do not pass it in source, shell history, URLs, prompts, or logs. Restrict network egress to the intended API endpoint. 2. Enforce workspace/model and user authorization before the request. Keep system instructions separate from untrusted content, validate lengths/encoding, and treat tool calls and outputs as untrusted data. 3. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/anth-security-basics