본문으로 건너뛰기
cccskills
무료GitHub에 공개

attio-security-basics

Review an Attio integration’s access, tenant boundaries, logs, and webhook handling. The skill identifies security gaps around credential scope, secret rotation, signature checks, and duplicate event processing, then returns findings and remediation owners.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

원문원문 설명 보기

Harden an Attio integration with least-privilege credentials, tenant isolation, log redaction, raw-body webhook verification, idempotency, and incident-ready rotation. Use when reviewing Attio security controls or preparing production access. Trigger with "Attio security", "secure Attio integration", or "Attio webhook signature".

jeremylongshore/tons-of-skills-marketplace

실행 점수 미검증

설치 방법 보기

이럴 때 유용합니다

  • Review security controls before production access
  • Check credential scopes and tenant isolation
  • Inspect webhook signature verification and deduplication
  • Prepare secret rotation and incident response

포함된 파일(2)

  • SKILL.md3.9 KB
  • references/official-docs.md2.1 KB

SKILL.md(원문)

설치하기 전에 에이전트에게 전달되는 지시 내용을 확인할 수 있습니다.

Attio Integration Security Baseline

Overview

This skill audits and hardens Attio authentication, data handling, webhook verification, tenant boundaries, and operational response without exposing secrets or customer records.

Prerequisites

  • Data-flow and trust-boundary inventory
  • Endpoint-to-scope map and tenant model
  • Secret-store, logging, retention, and incident-response owners
  • Webhook receiver code when events are enabled

Tool Discipline

Use Read, Glob, and Grep to inspect credential flow, authorization, logs, storage, and webhook handling. Use WebFetch only for current official Attio security contracts. Use Write or Edit after findings, target controls, and rollback conditions are approved.

Current Contract

  • Tokens should be least-privilege, stored server-side, tenant-bound, redacted, and rotatable.
  • Verify Attio-Signature by computing SHA-256 HMAC over the exact raw UTF-8 request body with the webhook secret and comparing equal-length hexadecimal values in constant time.
  • The signature input is the raw body only; do not invent a timestamp concatenation protocol.
  • Delivery is at least once. Use Idempotency-Key and durable state to control duplicates; signature verification alone is not deduplication.

Authentication

Prefer OAuth for multi-workspace applications and a workspace key for a controlled single workspace. Enforce server-side workspace authorization before resolving the encrypted token.

Instructions

  1. Map secrets, tenant context, Attio data, logs, queues, backups, and administrative paths.
  2. Compare used endpoints with granted scopes and remove unjustified privilege through an approved rotation.
  3. Enforce tenant authorization before credential resolution and storage access.
  4. Redact authorization headers, secrets, raw customer payloads, and sensitive attribute values from telemetry.
  5. Preserve the raw webhook body, verify its HMAC before parsing, compare equal-length buffers safely, and reject failures.
  6. Deduplicate accepted events by Idempotency-Key, queue work, and reconcile downstream state.
  7. Exercise token revocation, webhook-secret rotation, audit review, and incident rollback.

Approval Boundaries

Do not rotate production secrets, reduce retention, change access scopes, or replay customer mutations without the responsible security and service owners.

Output

Return the threat boundaries, scope gaps, secret lifecycle, webhook verification evidence, redaction tests, tenant-isolation tests, and remediation owners.

Error Handling

ConditionResponse
Raw webhook body is unavailableReject the event and fix middleware ordering.
Signature lengths differReject before constant-time comparison.
Token appears in retained outputRevoke or rotate it and scrub the artifact.
Duplicate idempotency key arrivesAcknowledge without repeating committed work.

Examples

Input:

scope=oauth service plus webhook receiver; environment=production candidate

Expected handoff:

least-privilege=verified; hmac=raw-body; dedupe=durable; rotation=exercised

Resources

리뷰

아직 리뷰가 없습니다. 사용해 본 소감을 남겨 주세요.

댓글

로그인 없이 쓸 수 있습니다. 사용 후기, 질문, 작동하지 않은 환경 등을 편하게 남겨 주세요.

아직 댓글이 없습니다. 첫 댓글을 남겨 보세요.

보내면 바로 공개됩니다. 이메일 주소나 전화번호 같은 개인 정보는 쓰지 마세요. URL은 2개까지입니다.

0 / 1,000자

이 양식은 reCAPTCHA로 보호되며 Google 개인정보처리방침 및 서비스 약관이 적용됩니다.

같은 저장소의 스킬

abridge-ci-integration

무료

Add a synthetic-data CI gate for customer-owned Abridge integration code. Test consent handling, note-review handoffs, redaction, and rollback behavior with mocked vendor boundaries, without connecting CI to a live Abridge or EHR tenant.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

  • Adding regression checks to an Abridge integration repository
  • Testing consent and note-release handling
  • Checking logs for sensitive data exposure
jeremylongshore/tons-of-skills-marketplace2.9천2026년 10월 23일 업데이트

abridge-common-errors

무료

Triage Abridge recording, note review, Epic handoff, and access problems using observed symptoms and approved guidance. Identify the affected workflow stage, organize a minimal timeline, and prepare a redacted escalation record for the responsible team.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

  • Separate recording problems from upload failures
  • Investigate note creation delays and editor issues
  • Identify the responsible team for Epic handoff failures
jeremylongshore/tons-of-skills-marketplace2.9천2026년 10월 23일 업데이트

abridge-core-workflow-a

무료

Map and review an Abridge clinical documentation workflow from consent and recording through draft review, evidence checks, edits, and final disposition. Keep clinician approval explicit, identify failure exits, and separate verified facts from tenant-specific details and pending approvals.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

  • Map a clinical note workflow for a care setting
  • Check where consent and patient identity are verified
  • Review draft notes against linked evidence before sign-off
jeremylongshore/tons-of-skills-marketplace2.9천2026년 10월 23일 업데이트

abridge-core-workflow-b

무료

Audit how clinician-reviewed Abridge note sections map into Epic templates and downstream workflows. Use approved test records to document destinations, exceptions, evidence, rollback steps, and a go or no-go decision for a specific environment.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

  • Checking Abridge note section mappings to Epic templates
  • Auditing a department’s approved documentation handoff
  • Preparing test evidence and a go or no-go decision
jeremylongshore/tons-of-skills-marketplace2.9천2026년 10월 23일 업데이트

abridge-cost-tuning

무료

Review Abridge adoption and workflow value using local usage records, clinician feedback, and verified contract costs. Build an evidence based decision table covering adoption, quality, support burden, and options to expand, hold, or improve the rollout.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

  • Reviewing adoption after an Abridge rollout
  • Preparing evidence for a renewal decision
  • Comparing workflow outcomes across care settings
jeremylongshore/tons-of-skills-marketplace2.9천2026년 10월 23일 업데이트

abridge-debug-bundle

무료

Prepare a bounded support bundle for an Abridge issue using allowlisted operational details such as versions, coarse timestamps, and correlation references. Exclude recordings, transcripts, patient identifiers, credentials, and unrestricted logs, then document redactions and review details.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

  • Preparing reviewed evidence for an Abridge support case
  • Documenting redactions and excluded data
  • Collecting approved operational details for an incident
jeremylongshore/tons-of-skills-marketplace2.9천2026년 10월 23일 업데이트

jeremylongshore의 스킬 모두 보기

이 스킬의 문제 신고