Agent skill · security · jeremylongshore
mindtickle-security-basics
Threat-model and harden a Mindtickle tenant and its identity, connector, API, content, and reporting integrations. Use when conducting security review or control remediation. Trigger with "secure Mindtickle integration".
Why this skill is useful
Provides specific API security practices and validation patterns for handling PII in MindTickle integrations that the AI wouldn't reliably generate on its own.
What it needs
Requires mindtickle account access. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Mindtickle Security and Privacy Control Review Overview Translate shared responsibility into testable controls for identities, tenant boundaries, employee data, content, integrations, evidence, and incident response. Prerequisites A scoped architecture, data inventory, identity model, contract registry, and accountable owners Current customer policy, threat model, retention schedule, and incident process Authorized access to Mindtickle trust artifacts and tenant-specific security documentation Tool Discipline Use Read, Glob, and Grep to inspect configuration and evidence, WebFetch for current official security material, and Write or Edit for the threat model, control matrix, and sanitized findings. Current Contract Mindtickle describes role-based access, customer responsibility for SSO, roles, provisioning, and data lifecycle, plus independent compliance and security assessments. Certifications inform assurance but do not replace customer control validation. Authentication Separate users, administrators, provisioning identities, managed connectors, API principals, and support access. Require least privilege, phishing-resistant identity controls where available, rotation, revocation, access review, and no shared credentials. Instructions 1. Inventory tenants, environments, principals, roles, integrations, data classes, content audiences, exports, caches, logs, and support paths. 2. Map threats across account takeover, overprivilege, tenant misrouting, lifecycle drift, data leakage, malicious content, replay, schema injection, and compromised dependencies. 3. Verify SSO enforcement, identity-provider MFA, provisioning ownership, disabled-user handling, administrator separation, and periodic access review. 4. Test tenant binding, input and output validation, secret handling, egress restrictions, encryption, logging redaction, and evidence integrity. 5. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/mindtickle-security-basics