Agent skill · security · jeremylongshore
instantly-security-basics
Harden Instantly API v2 keys, scopes, tenant boundaries, logs, webhooks, and operational access. Use when threat modeling, reviewing access, or assessing security before launch. Trigger with "secure an Instantly integration", "audit Instantly API keys", or "threat-model Instantly webhooks".
Why this skill is useful
Provides domain-specific knowledge on securing API keys and implementing least-privilege access for Instantly.ai that the AI wouldn't reliably generate on its own.
What it needs
Requires instantly account access. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Instantly Integration Security Baseline Overview Produce a verified security baseline with least privilege and explicit remediation approvals. Record assumptions, evidence, approval state, and rollback ownership so another operator can reproduce the result. Prerequisites The target repository, Instantly workspace, environment, and accountable owner Current security, privacy, compliance, capacity, and change-control requirements An approved API v2 key only when a bounded live verification is necessary Tool Discipline Use Read, Glob, and Grep to inspect code, configuration, and evidence. Use WebFetch only for current first-party Instantly documentation and package metadata. Use Write or Edit only when implementation was requested and exact target files are known; never write credentials, lead data, email content, or unrestricted environment output. Current Contract Keys are bearer credentials displayed once; store them only in approved server-side secret systems. Scopes can be resource/action-specific and revoked through API-key controls. Webhook payloads can contain sensitive lead and message content; the public guide does not establish a signature secret. Authentication Use an API v2 key as Authorization: Bearer <key> against https://api.instantly.ai/api/v2. Grant only the endpoint-specific scopes needed, inject the key from an approved server-side secret manager, and never print, persist, commit, or place it in a URL. Treat key creation, rotation, revocation, member changes, workspace delegation, and production access as owner-approved actions. Instructions 1. Inventory secrets, scopes, members, service identities, workspace-group delegation, and webhook destinations. 2. Remove browser exposure, query-string keys, plaintext configs, and unrestricted environment logging. 3. Map each call to least-privilege scopes and validate denied operations. 4. Enforce TLS, request-size bounds, schema validation, idempotency, and payload minimization at webhook receivers. 5. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/instantly-security-basics