Agent skill · security · jeremylongshore
evernote-security-basics
Implement security best practices for Evernote integrations.
Why this skill is useful
Provides specific security patterns and practices for Evernote API integrations that the AI wouldn't reliably generate on its own.
What it needs
Requires evernote account access. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Evernote Security Basics Overview Security best practices for Evernote API integrations, covering credential management, OAuth hardening, token storage, data protection, and secure logging patterns. Prerequisites Evernote SDK setup Understanding of OAuth 1.0a Basic cryptography concepts (AES encryption, hashing) Instructions Step 1: Credential Management Store consumerKey, consumerSecret, and access tokens in environment variables or a secrets manager (AWS Secrets Manager, GCP Secret Manager, HashiCorp Vault). Never commit credentials to source control. Add .env to .gitignore. Step 2: Secure OAuth Flow Add CSRF protection with a state parameter stored in the session. Validate the callback URL matches your registered domain. Use HTTPS-only for all OAuth endpoints. Set secure cookie flags for session tokens. Step 3: Encrypted Token Storage Encrypt access tokens at rest using AES-256-GCM before storing in your database. Decrypt only when making API calls. Store the encryption key separately from the database. Step 4: Input Validation Sanitize all user input before embedding in ENML. Validate note titles (max 255 chars), tag names (max 100 chars, no commas), and notebook names (max 100 chars). Strip forbidden HTML elements and attributes. Step 5: Secure Logging Redact access tokens, consumer secrets, and user email addresses from log output. Log only the first 8 characters of tokens for debugging correlation. Step 6: Token Lifecycle Management Track token expiration (edamexpires), implement proactive refresh before expiry, and handle AUTHEXPIRED errors gracefully. Tokens default to 1-year validity but users can set shorter durations. For the complete security implementation including encrypted storage, CSRF-protected OAuth, input validation, and audit logging, see Implementation Guide. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/evernote-security-basics--477600