Agent skill · security · jeremylongshore
onenote-security-basics
Establish a security baseline for delegated identity, consent, token caches, notebook content, logs, writes, and tenant isolation. Use when designing or hardening a OneNote integration. Trigger with "secure OneNote integration", "audit OneNote permissions", or "review OneNote token handling".
Why this skill is useful
Provides specific implementation details for secure authentication and permission management with the OneNote Graph API that the AI wouldn't reliably generate on its own.
What it needs
Requires node, python installed locally. Requires azure account access. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
OneNote Security Baseline Overview Establish a security baseline for delegated identity, consent, token caches, notebook content, logs, writes, and tenant isolation.. This workflow produces an auditable decision or artifact before any live action. Prerequisites Current first-party Microsoft Graph OneNote documentation and the selected integration's tested contract. Named identity, content, workload, security, and operations owners appropriate to the requested scope. Synthetic or approved non-production fixtures with secrets and real notebook content removed. Current Contract OneNote access is user-bound and content-rich. Effective authority depends on the delegated scope, signed-in user, target location, notebook sharing, application policy, and operation; generic application permission rows do not override the OneNote service's app-only prohibition. Recheck the dated evidence map before relying on mutable permissions, limits, SDK behavior, supported resources, or cloud availability. Authentication Use the minimum delegated Notes scope, encrypted token-cache storage, verified redirect URIs, tenant and user binding, redacted telemetry, revocation handling, and short retention for diagnostic evidence. Instructions 1. Inventory app registrations, redirect URIs, tenants, account types, users, scopes, caches, roots, operations, logs, and destinations. 2. Calculate effective access for every read, create, update, binary, copy, and export operation. 3. Remove app-only paths, default-scope assumptions, token logging, shared caches, and production fallbacks. 4. Add fail-closed tenant and user assertions plus content classification and minimization. 5. Test consent denial, revocation, cache theft, cross-user swaps, unauthorized roots, and log canaries. 6. Assign rotation, reauthentication, incident, retention, access-review, and exception owners. Tool Discipline Use Read, Glob, and Grep to inspect documentation, configuration, code, fixtures, and evidence. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/onenote-security-basics