Agent skill · security · jeremylongshore
quicknode-security-basics
Harden QuickNode endpoints with server-side token handling, separate credentials, least-privilege account roles, and plan-appropriate security filters. Use when reviewing exposure, isolating applications, or responding to a leaked endpoint. Trigger with: "secure QuickNode", "harden a QuickNode endpoint", "rotate a leaked QuickNode token".
Why this skill is useful
Provides specific implementation patterns and error handling for QuickNode security that the AI wouldn't reliably generate on its own.
What it needs
Requires quicknode account access. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
QuickNode Endpoint Hardening Overview Protect endpoint tokens as credentials, isolate consumers with multiple tokens, and layer only controls that match the client threat model. A browser referrer rule is not a substitute for keeping privileged RPC or account keys on a server. Prerequisites Endpoint inventory with owners, applications, and environments Current plan and available endpoint-security controls A threat model covering browser, server, CI, and operator access Instructions Step 1: Find exposure Use Read and Grep for quiknode.pro, x-token, x-api-key, JWT configuration, logs, examples, and client bundles. Stop and rotate any live credential committed to Git or shipped to an untrusted client. Step 2: Separate identities Create distinct endpoint tokens for applications and environments. Keep Admin API/SDK API keys separate from chain RPC tokens. Apply least-privilege team and account roles. Step 3: Choose layered controls Use token authentication for every endpoint. Add JWT for short-lived server authorization when supported, referrer allowlists for browser-origin reduction, and IP or method limits for known traffic patterns. Document plan dependencies. Step 4: Keep privileged calls server-side Use Write or Edit to route transaction submission, archive/debug methods, and account-control calls through a trusted backend. Do not embed endpoint or API tokens in public JavaScript. Step 5: Inspect configuration Use Bash(qn:) to read endpoint security state with an approved authenticated operator identity. Compare actual tokens, filters, limits, domains, and team access to the declared policy without printing secret values. Step 6: Exercise response Prove that an unauthorized origin, token, method, or IP is rejected as designed. Revoke one test token and confirm other isolated consumers continue. Record recovery time and escalation owner. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/quicknode-security-basics