Agent skill · security · jeremylongshore
ramp-security-basics
Establish least-privilege OAuth, secret, webhook, data, card, and financial-write controls for a Ramp integration. Use when threat modeling, reviewing a launch, or remediating controls. Trigger with "secure Ramp integration" or "Ramp security review".
Why this skill is useful
Provides specific API integration patterns and error handling for Ramp's corporate card management that the AI wouldn't reliably generate on its own.
What it needs
Requires ramp account access. About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Ramp Integration Security Baseline Overview Protect credentials and financial authority as separate assets. Minimize scopes and data paths, verify webhook authenticity from raw bytes, and require idempotent, approved, reconciled writes. Prerequisites Identify the Ramp application, environment, business entities, affected data and workflows, accountable owner, and rollback boundary. Read references/official-docs.md and re-check endpoint schemas, scopes, limits, and support status before a live operation. Use synthetic fixtures or Ramp sandbox until production access and business effects are explicitly approved. Prepare approved secret storage and a sanitized evidence location. Current Contract Ramp access tokens are opaque bearer credentials bound to environment and scope; they must not be logged or exposed to browser code. Webhook subscriptions return a secret and deliveries include X-Ramp-Signature, an HMAC-SHA256 signature over the exact raw request body. Embedded Cards can keep PAN/CVV outside application servers; Vault brings card data into the backend and requires production approval. Authorization Code flows require strong state verification and exact redirect URIs; Client Credentials is for internal server-side integrations. Instructions 1. Threat-model clients, redirects, token exchange, secret stores, API adapters, webhook ingress, queues, logs, card delivery, accounting writes, admin access, and support paths. 2. Split applications by trust boundary, request minimum scopes, isolate environments and tenants/entities, and assign rotation plus emergency revocation owners. 3. Verify webhook signatures over raw bytes before parsing, validate expected event type and business, deduplicate by event ID, and process asynchronously. 4. Prefer embedded card delivery; isolate any approved Vault service and prohibit PAN/CVV from logs, queues, analytics, support tools, and general databases. 5. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/ramp-security-basics--7ceb0c