Agent skill · security · jeremylongshore
persona-security-basics
Harden Persona API keys, identity data, inquiry sessions, webhook verification, and destructive redaction. Use when conducting a security review. Trigger with: "secure Persona integration", "Persona PII controls", "audit Persona webhook security".
Why this skill is useful
Adds specific implementation patterns for securely handling Persona API keys and PII that the AI wouldn't reliably generate on its own.
What it needs
Requires persona account access. About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Persona PII, Key, Session, and Webhook Controls Overview Treat the integration as a high-sensitivity identity boundary. Separate server API keys, short-lived inquiry session tokens, and webhook secrets; minimize collected PII; authenticate every event; and make destructive redaction an explicit governed operation. Prerequisites Data-flow and threat model for the Persona integration Owners for credentials, privacy, incidents, retention, and redaction Approved environment, template, webhook, and access-control inventory Instructions Step 1: Classify secrets and data Inventory bearer keys, webhook secrets, session tokens, identity attributes, documents, images, logs, and derived decisions with owners and retention. Step 2: Enforce environment isolation Use distinct secret scopes, endpoints, templates, and access policies for sandbox and production. Deny production data in developer fixtures. Step 3: Minimize privilege and exposure Restrict keys and operator roles, keep Persona calls server-side, redact headers and bodies, and prevent session tokens from analytics or URLs. Step 4: Authenticate raw events Parse Persona-Signature, compute SHA-256 HMAC over timestamp + '.' + rawBody, compare all v1 candidates in constant time, and enforce a reviewed timestamp tolerance. Step 5: Make processing replay-safe Deduplicate event IDs and order business transitions by provider created-at, because deliveries may repeat or arrive out of order. Step 6: Govern redaction Require subject, resource, authorization, impact preview, child-resource expectations, and evidence before invoking redaction. It cannot be undone and child redaction is asynchronous. Authentication REST uses an environment bearer API key; event intake uses the endpoint webhook secret; browser flows receive only the intended inquiry session token. These credentials are not interchangeable. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/persona-security-basics--816cd4