Agent skill · security · jeremylongshore
salesloft-security-basics
Harden Salesloft tenant isolation, OAuth and API-key storage, least-privilege scopes, CRM-data handling, and webhook verification. Use when reviewing an integration security boundary. Trigger with "Salesloft security", "secure Salesloft tokens", or "Salesloft webhook verification".
Why this skill is useful
Provides specific implementation patterns and security practices for managing SalesLoft API credentials and tokens that the AI wouldn't reliably generate on its own.
What it needs
Requires salesloft account access. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Salesloft Integration Security Boundary Overview This skill reviews how credentials, tenant context, prospect data, mutations, and webhook deliveries move through an integration. It produces remediations tied to evidence and named owners. Prerequisites Architecture, data-flow, scope, and secret inventories Named Salesloft teams, environments, and data owners Current webhook subscription configuration Incident and credential-rotation procedures Tool Discipline Use Read, Glob, and Grep to inspect auth, logging, storage, routing, and signature code. Use WebFetch only for official Salesloft security contracts. Use Write or Edit only after the remediation target is confirmed. Current Contract Every API credential is a Bearer secret and must remain server-side. Authorization-code refresh rotates the refresh token; client credentials have no refresh token. API keys act as the issuing customer user and are not the partner application path. x-salesloft-signature is a hex SHA-1 HMAC of the exact request body using callbacktoken as the key. Salesloft does not document a timestamp header in the general delivery-header contract, so do not invent timestamp replay verification. Authentication Bind each encrypted credential record to one Salesloft team, flow, scope set, environment, owner, and rotation state. Fail closed when tenant context is missing or mismatched. Instructions 1. Trace credential acquisition, storage, decryption, refresh, injection, revocation, and audit events. 2. Verify least-privilege scopes against every used method and path. 3. Enforce explicit tenant context across queues, caches, jobs, logs, and database keys. 4. Redact Authorization, token, callback-token, email, phone, and CRM fields from diagnostics. 5. Verify webhook HMAC over exact raw bytes with equal-length constant-time comparison. 6. Validate the event type and callback token, then apply durable deduplication before side effects. 7. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/salesloft-security-basics