Agent skill · software engineering · jeremylongshore
runway-security-basics
Harden Runway keys, organization access, prompts, media, generated outputs, and support evidence. Use when threat-modeling an integration. Trigger with: "secure Runway API", "Runway key rotation", "Runway media privacy".
Why this skill is useful
Provides specific implementation patterns and error handling for the Runway API that the AI wouldn't reliably generate on its own.
What it needs
Requires runwayml installed locally. Requires runway account access. About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Runway Credential, Media, and Moderation Controls Overview Runway integrations handle organization-scoped credentials and potentially sensitive media. Security must cover key lifecycle, server-only egress, input rights, temporary URL capabilities, moderation outcomes, output access, evidence minimization, and incident response. Prerequisites Data classification and media-rights policy Runway organization role and key inventory Secret manager, private object storage, audit logging, and incident owners Instructions Step 1: Inventory identities and keys List organization members, roles, keys, consumers, environments, creation dates, and rotation owners. Removing a member does not disable their organization-scoped keys, so revocation is a separate control. Step 2: Enforce server-only access Keep RUNWAYMLAPISECRET in a secret manager and restrict egress to Runway hosts. Prevent browser exposure, repository commits, shell history, build arguments, logs, traces, and support archives. Step 3: Govern input content Verify rights, tenant authorization, data minimization, acceptable-use policy, file type and size, and public-URL exposure. Treat prompts and source media as sensitive application data. Step 4: Handle moderation honestly Expect moderation as a failed task and inspect failureCode. Do not automatically retry safety failures or expose unsafe diagnostics; repeated moderated requests can threaten account availability. Step 5: Control media capabilities Treat public input URLs, runway:// URIs, and signed output URLs as temporary access capabilities. Copy approved output to owned private storage, scan and validate it, and issue internal authorized links. Step 6: Prove rotation and response Rotate keys through a canary, explicitly disable old credentials, scan for leaks, and maintain a playbook for revocation, artifact restriction, customer notification, and evidence deletion. Authentication Bearer secrets authenticate the organization, not an end user. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/runway-security-basics--54de85