Agent skill · security · jeremylongshore
hootsuite-security-basics
Apply Hootsuite security best practices for secrets and access control.
Why this skill is useful
Provides specific security practices and code snippets for managing Hootsuite API credentials that the AI wouldn't reliably generate on its own.
What it needs
Requires hootsuite account access. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Hootsuite Security Basics Credential Inventory Credential Scope Rotation ----------- ------- ---------- Client ID App-level Never (app identifier) Client Secret App-level Rotate if compromised Access Token User session Auto-expires (~1 hour) Refresh Token User session Rotate on each refresh Instructions Step 1: Secure Token Storage Step 2: Token Refresh Security Step 3: Security Checklist [ ] Client secret in secrets vault, never in code [ ] Access tokens never logged or exposed [ ] Refresh tokens stored encrypted [ ] HTTPS for all OAuth requests [ ] Pre-commit hook blocks HOOTSUITE credential leaks [ ] Separate OAuth apps for dev/staging/prod Overview Public publishing is a high-impact boundary: credentials, profile scope, audience selection, approval state, copy, and media must all be protected. This guidance keeps draft and publication paths distinct and auditable. Prerequisites A threat model naming credential custodians, account owners, approved profiles/audiences, incident owner, and secret manager. Low-privilege sandbox credentials, draft-only fixtures, and tested revoke/disable/cancel procedures. Output Return a security receipt with environment, profile scope, reference version, approval/audience validation, revocation state, correlation ID, and rollback action. Never include tokens, copy, media, or account identities. Error Handling Stop for unknown profile/audience, absent approval, failed signature/validation, or public-post attempt from an unapproved path. Revoke credentials or disable scheduling when integrity is uncertain. Examples env=staging; profile=sandbox-brand; referenceversion=version-12; approval=pass; audience=approved; publicposts=0; rollback=scheduler-disabled is an auditable control result. Resources Hootsuite OAuth 2.0 Next Steps For production, see hootsuite-prod-checklist.
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/hootsuite-security-basics