Agent skill · security · jeremylongshore
lucidchart-security-basics
Threat-model and harden Lucid API, Standard Import, editor extension, and data connector integrations. Use when reviewing secrets, scopes, data flows, or release security. Trigger with "secure Lucid integration".
Why this skill is useful
Adds executable scripts for OAuth2 token management and webhook verification that enhance security practices for Lucidchart integrations.
What it needs
Requires lucidchart account access. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Lucid Integration Security Baseline Overview Establish least privilege, safe data handling, trustworthy package boundaries, and auditable operations for the exact Lucid integration surface. Prerequisites Architecture and data-flow inventory with classifications and owners Credential/principal and extension-scope inventory Repository, artifact, deployment, logging, retention, and incident evidence Tool Discipline Use Read, Glob, and Grep for bounded static inspection, WebFetch for current Lucid security contracts, and Write or Edit only for approved local remediation and redacted reports. Current Contract Lucid exposes multiple credential classes, operation-specific scopes/headers, Standard Import archives, editor-extension scopes, and optional connector runtimes. Each creates distinct trust boundaries; an extension bundle is not a safe place for confidential credentials. Authentication Map API keys and OAuth user/account tokens to an owner, exact scopes/resources, storage, expiration, rotation, revocation, and audit trail. Validate OAuth redirect URIs and state. Never log tokens, authorization codes, refresh tokens, cookies, or signed URLs. Instructions 1. Pin the reviewed revision and enumerate actors, components, data stores, network edges, documents, and source systems. 2. Re-fetch authentication, scope, header, and surface-specific official docs. 3. Search tracked files and build artifacts for credentials, unsafe environment files, overly broad scopes, sensitive fixtures, and unredacted logs. 4. Threat-model credential theft, malicious imports, archive traversal/expansion, injected source data, cross-account access, connector compromise, replay, and supply-chain drift. 5. Validate inputs, archive paths/sizes/types, stable IDs, outputs, redirects, state, authorization, tenant boundaries, and redaction. 6. Verify pinned dependencies, reproducible builds, artifact provenance, change review, secretless CI, and rollback. 7. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/lucidchart-security-basics