Agent skill · security · jeremylongshore
clari-security-basics
Secure Clari identities, credentials, exported revenue data, Copilot content, and ingestion mutations. Use when threat-modeling or reviewing least privilege and data handling. Trigger with: "secure Clari", "threat-model Clari", "review Clari access".
Why this skill is useful
Adds specific scripts and best practices for securing Clari API tokens and handling PII data that the AI wouldn't reliably generate on its own.
What it needs
Requires aws account access. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Secure Clari Data Integration Boundary Overview Protect both control-plane credentials and the business data they unlock. Clari exports can contain hierarchy, identity, forecast, quota, CRM, activity, and conversation data, while ingestion and Copilot CRM endpoints can mutate provider state. Prerequisites Integration data-flow diagram and endpoint inventory Named secret, privacy, retention, and incident owners Destination encryption, access-control, audit, and deletion capabilities Instructions Step 1: Classify every flow Identify credentials, user and participant identifiers, revenue values, activity metadata, transcripts, recordings, and CRM objects by sensitivity. Step 2: Minimize authority Use dedicated identities, separate Revenue, ingestion, and Copilot secrets, narrow hierarchy or workspace access, and deny mutation endpoints unless required. Step 3: Protect credentials Store only references in configuration, redact all documented auth headers, rotate on schedule, and test revocation without exposing values. Step 4: Protect data in motion and at rest Require HTTPS, encryption, restricted landing zones, field-level minimization, retention limits, and governed deletion. Step 5: Constrain mutations Gate ingestion and Copilot create, update, or delete actions behind validation, reconciliation, explicit operator approval, and rollback planning. Step 6: Exercise response Test credential exposure, overbroad access, incorrect export publication, and unauthorized mutation scenarios; retain redacted evidence. Authentication Revenue apikey, ingestion partnerkey, and Copilot key/password credentials are distinct high-impact secrets. Never log them, accept them in free-form prompts, or reuse one surface’s credential in another client. Tool Discipline Use Read and Grep to inspect configuration, provider contracts, fixtures, logs, schemas, and existing tests before proposing a change. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/clari-security-basics