Agent skill · security · jeremylongshore
flexport-security-basics
Analyze and harden Flexport credentials, tokens, webhook verification, data exposure, and mutation controls. Use when performing threat modeling, security review, credential rotation, or receiver implementation. Trigger with: "secure Flexport integration", "review Flexport secrets", "Flexport webhook security".
Why this skill is useful
Provides specific security practices and code snippets for managing Flexport API security that are not widely known.
What it needs
Requires flexport account access. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Flexport Integration Security Baseline Overview Protect four high-value boundaries: OAuth/API credentials, cached tokens, webhook secrets/raw bodies, and business mutations that can create freight or trade records. Prerequisites Threat model with account, workload, and data boundaries Endpoint-scoped credential plan and broad-key exception register Secret scanning, redacted telemetry, rotation, and incident procedures Instructions Step 1: Minimize credentials Prefer distinct endpoint-scoped OAuth clients. Treat API keys as broad-access exceptions and never record secret values or suffixes. Step 2: Protect tokens Request with the documented audience/grant, cache encrypted 24-hour JWTs, single-flight refresh, and never pass tokens through browser state or logs. Step 3: Authenticate webhooks first Verify raw-body HMAC-SHA256 from X-Hub-Signature-256, reject malformed/length-mismatched values, then parse and enqueue. Step 4: Constrain egress and input Allow documented Flexport hosts, validate schemas and sizes, preserve opaque IDs, and reject unexpected mutation intent. Step 5: Guard mutations Require business authorization, durable operation keys, one writer, and reconciliation before retrying bookings or record creation. Step 6: Exercise response Test credential revocation, webhook secret rotation, log leakage, provider outage, and rollback with metadata-only evidence. Authentication REST calls authenticate with a cached OAuth 2.0 client-credentials Bearer token using audience https://api.flexport.com, or an explicitly accepted broad API key. Use distinct credentials per workload and never log credentials or tokens. MCP calls use the authenticated connection to https://mcp.flexport.com/mcp and remain subject to each tool's documented account permissions. Tool Discipline Use Read and Grep for discovery and evidence. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/flexport-security-basics