Review an Algolia integration for exposed write-capable keys, overly broad index access, and records visible to search users. The skill maps credentials and permissions, checks tenant restrictions, and produces findings, remediation steps, and a key rotation plan.
中文简介正在准备中。当前显示英语简介。
Audit and harden Algolia credentials, record exposure, index restrictions, and tenant search controls. Use when reviewing frontend keys, backend ACLs, key rotation, or data visibility. Trigger with "secure Algolia", "Algolia key audit", or "Algolia security review".
实测评分 未实测
查看安装方法安装前可以查看交给 AI 代理的指令内容。
This skill reviews the actual security boundary of an Algolia integration. A browser search-only key is intentionally visible, so record contents, index restrictions, secured-key design, and abuse controls remain essential.
Use Read, Glob, and Grep to inspect local code, configuration names, tests, and dependency versions. Use WebFetch only for current official Algolia documentation. Use Write or Edit only after identifying the target files, constraints, and verification plan.
Inspect key metadata without exporting secret values. Admin credentials stay out of application defaults, browser bundles, logs, support artifacts, and developer examples.
Do not rotate or revoke production keys, alter index restrictions, or remove access until dependencies and recovery paths are verified.
Return the key and actor inventory, exposure findings, data-visibility review, allowed/denied tests, remediation plan, rotation procedure, and residual risks.
| Condition | Response |
|---|---|
| Write key found in browser | Contain and rotate through the incident process. |
| Search key exposes sensitive records | Remove the data and review index design. |
| Tenant restriction bypassed | Disable affected path and correct server-generated restrictions. |
| Key owner unknown | Treat it as orphaned and investigate before revocation. |
Use this compact input and expected handoff to calibrate scope and evidence quality.
Input:
app=APP…9X; actors=browser,indexer,ops; indices=products_*
Expected handoff:
browser=search-only; indexer=custom-minimum; tenant-denial=pass; exposed-write-key=none
还没有评价。欢迎分享你的使用感受。
无需登录即可发表。欢迎分享使用感受、提问，或说明在哪些环境下无法运行。
还没有评论。来写第一条吧。
Add a synthetic-data CI gate for customer-owned Abridge integration code. Test consent handling, note-review handoffs, redaction, and rollback behavior with mocked vendor boundaries, without connecting CI to a live Abridge or EHR tenant.
中文简介正在准备中。当前显示英语简介。
Triage Abridge recording, note review, Epic handoff, and access problems using observed symptoms and approved guidance. Identify the affected workflow stage, organize a minimal timeline, and prepare a redacted escalation record for the responsible team.
中文简介正在准备中。当前显示英语简介。
Map and review an Abridge clinical documentation workflow from consent and recording through draft review, evidence checks, edits, and final disposition. Keep clinician approval explicit, identify failure exits, and separate verified facts from tenant-specific details and pending approvals.
中文简介正在准备中。当前显示英语简介。
Audit how clinician-reviewed Abridge note sections map into Epic templates and downstream workflows. Use approved test records to document destinations, exceptions, evidence, rollback steps, and a go or no-go decision for a specific environment.
中文简介正在准备中。当前显示英语简介。
Review Abridge adoption and workflow value using local usage records, clinician feedback, and verified contract costs. Build an evidence based decision table covering adoption, quality, support burden, and options to expand, hold, or improve the rollout.
中文简介正在准备中。当前显示英语简介。
Prepare a bounded support bundle for an Abridge issue using allowlisted operational details such as versions, coarse timestamps, and correlation references. Exclude recordings, transcripts, patient identifiers, credentials, and unrestricted logs, then document redactions and review details.
中文简介正在准备中。当前显示英语简介。