Agent skill · security · jeremylongshore
miro-security-basics
Audit and harden repository-side Miro OAuth, session, storage, scope, logging, and board-data controls against common integration failures. Use when security-reviewing a Miro app. Trigger with \"secure Miro integration\".
Why this skill is useful
Provides specific security best practices for Miro's OAuth 2.0 implementation and webhook validation that the AI wouldn't reliably generate on its own.
What it needs
Requires miro account access. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Miro Integration Security Baseline Overview Apply a minimum security baseline tied to Miro's supported authorization model and the app's actual data flows. Eliminate obsolete webhook assumptions from the threat model; use the evidence produced here to make the next decision explicit and reviewable. Prerequisites Data-flow and trust-boundary diagram App configuration, scopes, token mode, and storage design Threat model and approved data-retention policy Tool Discipline Use Read, Glob, and Grep to inspect the repository, configuration names, adapters, tests, and evidence. Use WebFetch only for current official Miro documentation. Use Write or Edit after confirming the requested mode, target environment, tenant, board, and approval boundary. These declared tools do not call authenticated Miro APIs or deployment CLIs; implement client, configuration, and test changes, then return exact operator commands or an approval-gated handoff for live execution. Current Contract Miro requires OAuth 2.0 for REST apps and tells Marketplace apps not to request user credentials. Every request must be authenticated and authorized; stored Miro user data requires its own access control. Session cookies should be HttpOnly and Secure; OAuth callbacks require session-bound state validation. The retired experimental webhook service provides no current server-to-server signature contract to implement. Authentication For REST work, use OAuth 2.0 Authorization Code with the narrowest Miro scopes. Bind each encrypted token record to its user, application, authorized team, and granted scopes. Never print access tokens, refresh tokens, client secrets, authorization codes, or board content. Instructions 1. Map entry points, OAuth redirects, sessions, tokens, board data, logs, exports, and administrators. 2. Minimize scopes and verify authorization again at each server-side tenant/resource boundary. 3. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/miro-security-basics