Agent skill · security · jeremylongshore
lindy-security-basics
Implement security best practices for Lindy agents and integrations.
Why this skill is useful
Provides specific security practices and code snippets for managing API keys and webhooks that are tailored to Lindy AI agents.
What it needs
Requires lindy account access. About 5k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Lindy Security Basics Overview Secure Lindy workflows at the boundaries Lindy currently documents: generated Webhook Received secrets, per-action connected-account selection, target-service authentication in HTTP Request, Ask for Confirmation/draft modes, dedicated Computer Use sessions, Tasks, and Test Panel. Do not rely on an undocumented Lindy API key, webhook signature, role, connection-sharing level, fixed quota, or plan entitlement. Prerequisites Lindy workspace with an editable custom agent Inventory of triggers, actions, connected accounts, external endpoints, data classes, owners, and consequential side effects Sanitized fixtures and test/sandbox integrations Instructions Step 1: Draw the Trust Map For every path, record source, destination, data fields, credential owner, selected connected account, allowed side effects, approver, failure path, and evidence source. Separate these directions: Direction Supported boundary --- --- Application to Lindy Webhook Received URL + Lindy-generated bearer secret Lindy to external service HTTP Request + that service's authentication External account action Exactly the connected account selected on the action Lindy callback to application Receiver-owned trust boundary; no documented Lindy signature claim Step 2: Secure Webhook Received 1. Create the webhook inside the Webhook Received trigger. 2. Generate the secret, copy it once, and store it in the caller's secret manager. 3. Send it only in the Authorization bearer header to the generated HTTPS URL. 4. Keep the webhook URL/secret out of prompts, bodies, query strings, task titles, screenshots, logs, and tickets. 5. Minimize and validate the caller's payload before transmission. 6. Rotate after suspected exposure by creating/reconfiguring the protected boundary, verifying the replacement, and retiring the old value according to the current UI. The bearer secret authenticates the caller to Lindy. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/lindy-security-basics--0a2854