Agent skill · security · jeremylongshore
procore-security-basics
Threat-model a Procore integration across OAuth credentials, company routing, DMSA permissions, webhooks, files, logs, and revocation. Use when reviewing a new app, hardening production, or responding to credential exposure. Trigger with: "secure a Procore integration", "review Procore API security", "rotate Procore credentials".
Why this skill is useful
Provides specific API call patterns and error handling for Procore's security integration that the AI wouldn't reliably generate on its own.
What it needs
Requires procore account access. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Procore Integration Security Boundary Overview Protect construction data by constraining identity, company and project scope, transport, stored artifacts, and operator actions. Procore authorization is permission-based; neither a valid token nor a successful request proves least privilege. Prerequisites Data-flow diagram, asset classification, trust boundaries, and named security owner OAuth grant, credential locations, DMSA manifest, and permitted-project inventory Webhook destinations, file flows, log sinks, support path, and revocation procedure Instructions Step 1: Inventory secrets and principals Locate client secrets, access and refresh tokens, webhook destination secrets, cookies, and signed URLs. Ensure each secret has an owner, approved store, rotation path, and narrow audience. Step 2: Prove least privilege Map every endpoint to its required Procore tool permission and project scope. For DMSAs, compare the manifest with installed permitted projects and remove unexplained access. Step 3: Bind company routing Carry company context explicitly and validate Procore-Company-Id where required. Prevent a multi-company worker or event handler from reusing stale tenant context. Step 4: Protect data paths Use supported TLS, authenticate secure-file downloads as documented, sanitize logs and traces, and keep payload retention proportional to the business requirement. Step 5: Harden mutations Separate preview from execution, require approval for consequential changes, validate project ownership, and reconcile provider state after writes. Step 6: Exercise response Test revocation, credential rotation, app disconnection, webhook-secret rotation, and audit retrieval. Record recovery time without exposing the secrets under test. Authentication Procore API access uses OAuth 2.0 Bearer tokens from Authorization Code or DMSA Client Credentials. Store client secrets server-side, rotate credentials regularly, and revoke authorization when access is no longer valid. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/procore-security-basics