Agent skill · security · jeremylongshore
fireflies-security-basics
Harden Fireflies bearer authentication, GraphQL selections, webhook signatures, logs, and privileged mutations against secret and meeting-data exposure. Use when performing security review or baseline implementation. Trigger with "secure Fireflies", "Fireflies threat model", or "Fireflies key safety".
Why this skill is useful
Provides specific HMAC-SHA256 verification patterns and API key management practices for Fireflies.ai that the AI wouldn't reliably generate on its own.
What it needs
Requires fireflies account access. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Fireflies Integration Security Baseline Overview Harden Fireflies bearer authentication, GraphQL selections, webhook signatures, logs, and privileged mutations against secret and meeting-data exposure. Prerequisites The target repository or integration path and the requested operator outcome. The Fireflies principal, team, environment, and data classification for the work. Current Fireflies documentation, credentials only when needed, and an accountable approver. Current Contract Protect two independent secrets: the API bearer key for outbound GraphQL and the Webhooks V2 signing secret for inbound HMAC verification. Verify X-Hub-Signature over the raw body as sha256=HEXDIGEST with a timing-safe comparison before parsing. Authentication For authenticated operations, inject FIREFLIESAPIKEY from an approved secret manager and send it only as Authorization: Bearer REDACTEDKEY to https://api.fireflies.ai/graphql. Never print, commit, place in a URL, forward to a browser, or include the key in evidence. Webhook signing secrets are separate credentials and must not be reused as API keys. Instructions 1. Inventory API keys, webhook secrets, principals, environments, and data flows. 2. Keep bearer calls server-side and use separate secrets per environment. 3. Restrict GraphQL documents and selected fields to reviewed operations. 4. Verify webhook signatures on raw bytes, reject missing or malformed headers, then parse JSON. 5. Redact Authorization, signatures, meeting IDs, emails, text, summaries, and media URLs from logs. 6. Gate role, privacy, sharing, channel, upload, live-meeting, and deletion mutations. 7. Test key rotation, replay handling, redaction, and incident response. Tool Discipline Use Read, Glob, and Grep to inspect code, configuration, tests, and evidence. Use Write/Edit only for approved implementation or documentation changes. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/fireflies-security-basics