New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Clay Security Basics

by jeremylongshore in jeremylongshore/tons-of-skills-marketplace

Apply Clay security best practices for API keys, webhook secrets, and data access control.

MITAuto-check: notesBackend & APIs

Install Clay Security Basics

skills CLI
$ npx skills add jeremylongshore/tons-of-skills-marketplace --skill clay-security-basics -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install jeremylongshore/tons-of-skills-marketplace clay-security-basics --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/jeremylongshore/tons-of-skills-marketplace.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/.curated/clay-security-basics .claude/skills/clay-security-basics && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
clay-security-basics
GitHub stars
2.8k
Token cost
~1.7k tokens
SKILL.md length
441 words
Files
1
Skills in repo
3,342
Repo updated
First seen
Licence
MIT

At a glance

Apply Clay security best practices for API keys, webhook secrets, and data access control.

  • Works in 6 steps: Secure API Key Storage → Authenticate Incoming Webhook Callbacks → Isolate Provider API Keys → …
  • Securing Clay integrations
  • SKILL.md covers Overview, Prerequisites, Instructions and Error Handling, plus 4 more sections
  • Calls gh, gcloud and aws; reaches api.clay.com; needs CLAY_WEBHOOK_SECRET and CLAY_API_KEY

What it does

Clay Security Basics is an agent skill from jeremylongshore/tons-of-skills-marketplace. Apply Clay security best practices for API keys, webhook secrets, and data access control. Use when securing Clay integrations, rotating API keys, auditing access, or implementing webhook authentication. Trigger with phrases like "clay security", "clay secrets", "secure clay", "clay API key security", "clay webhook security".

Its SKILL.md is about 1.7k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts. Compatibility notes: Designed for Claude Code

It sits in Backend & APIs, covering Webhooks, Authorization and RBAC and Security review. The repository describes itself as: Model-agnostic agent-skills platform with a harness-free canonical layer, verified adapters, and the ccpi package manager. Explore at tonsofskills.com. The licence is MIT.

When your agent uses it

  • Securing Clay integrations
  • Rotating API keys
  • Auditing access
  • Implementing webhook authentication

Example prompts

  • “clay security”
  • “clay secrets”
  • “secure clay”
  • “/clay-security-basics”

Requirements

  • A credential in CLAY_API_KEY
  • A credential in CLAY_WEBHOOK_SECRET
  • Compatibility (from SKILL.md): Designed for Claude Code
  • Pre-approved tools (allowed-tools): Read, Write, Edit, Grep

Workflow steps

6 steps, taken from the step headings in SKILL.md.

  1. Secure API Key Storage
  2. Authenticate Incoming Webhook Callbacks
  3. Isolate Provider API Keys
  4. API Key Rotation Procedure
  5. Protect Enriched Lead Data
  6. Security Checklist

What it can do on your machine

Read from SKILL.md and the folder at commit cfae287. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves these tools, so the agent can use them without asking each time:

    • Read
    • Write
    • Edit
    • Grep

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • gh
    • gcloud
    • aws
    • curl
    • jq
    • git

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Hosts in commands or code, which the agent is likely to contact:

    • api.clay.com

    Also links to:

    • university.clay.com
    • owasp.org

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names these keys or tokens, usually read from environment variables:

    • CLAY_WEBHOOK_SECRET
    • CLAY_API_KEY
    • NEW_CLAY_API_KEY

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

  • Compatibility

    Designed for Claude Code

    From compatibility in the SKILL.md frontmatter.

Context cost

Clay Security Basics loads about 1.7k tokens when it runs. Until then it costs about 87 tokens; SKILL.md has 441 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~87
When it runs · the whole SKILL.md, loaded when a task matches
~1.7k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check: notes

The automated check noted patterns worth knowing about, such as sudo or a known installer.

  • NoteMentions a .env fileSKILL.md:44
    # .env (NEVER commit to git)
  • NoteMentions a .env fileSKILL.md:49
    .env
  • NoteMentions a .env fileSKILL.md:50
    .env.local
  • NoteMentions a .env fileSKILL.md:51
    .env.*.local
  • NoteMentions a .env fileSKILL.md:167
    - [ ] `.env` files in `.gitignore`

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from jeremylongshore/tons-of-skills-marketplace at commit cfae287, republished under its MIT licence (© jeremylongshore). 441 words, ~1,685 tokens.

Download SKILL.mdSave it as .claude/skills/clay-security-basics/SKILL.md (or your agent's skills folder).
name
clay-security-basics
description
Apply Clay security best practices for API keys, webhook secrets, and data access control. Use when securing Clay integrations, rotating API keys, auditing access, or implementing webhook authentication. Trigger with phrases like "clay security", "clay secrets", "secure clay", "clay API key security", "clay webhook security".
allowed-tools
Read, Write, Edit, Grep
compatibility
Designed for Claude Code
version
1.14.0
license
MIT
author
Jeremy Longshore <jeremy@intentsolutions.io>
tags
saas, clay, api, security, audit

Clay Security Basics

Overview

Security best practices for Clay integrations covering API key management, webhook endpoint security, provider credential isolation, and lead data protection. Clay handles sensitive PII (emails, phone numbers, LinkedIn profiles) at scale, making security critical.

Prerequisites

  • Clay account with admin access
  • Understanding of environment variables and secrets management
  • Access to deployment platform's secrets manager

Instructions

Step 1: Secure API Key Storage
bash
# .env (NEVER commit to git)
CLAY_API_KEY=clay_ent_your_api_key_here
CLAY_WEBHOOK_URL=https://app.clay.com/api/v1/webhooks/your-id

# .gitignore — add these patterns
.env
.env.local
.env.*.local
*.key

For production, use your platform's secrets manager:

bash
# GitHub Actions
gh secret set CLAY_API_KEY --body "clay_ent_your_key"

# Google Cloud Secret Manager
echo -n "clay_ent_your_key" | gcloud secrets create clay-api-key --data-file=-

# AWS Secrets Manager
aws secretsmanager create-secret \
  --name clay/api-key \
  --secret-string "clay_ent_your_key"
Step 2: Authenticate Incoming Webhook Callbacks

When Clay's HTTP API columns call your endpoint, validate the request origin:

typescript
// src/middleware/clay-auth.ts
import crypto from 'crypto';

const CLAY_WEBHOOK_SECRET = process.env.CLAY_WEBHOOK_SECRET!;

function verifyClayCallback(
  payload: string,
  signature: string | undefined
): boolean {
  if (!signature || !CLAY_WEBHOOK_SECRET) return false;

  const expected = crypto
    .createHmac('sha256', CLAY_WEBHOOK_SECRET)
    .update(payload)
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(signature, 'hex'),
    Buffer.from(expected, 'hex')
  );
}

// Express middleware
function clayAuthMiddleware(req: any, res: any, next: any) {
  const signature = req.headers['x-clay-signature'] as string;
  const rawBody = JSON.stringify(req.body);

  if (!verifyClayCallback(rawBody, signature)) {
    console.warn('Rejected unauthorized Clay callback from', req.ip);
    return res.status(401).json({ error: 'Invalid signature' });
  }
  next();
}
Step 3: Isolate Provider API Keys

Connect provider keys directly in Clay (Settings > Connections) rather than passing them through your application. This keeps provider credentials out of your codebase:

ProviderWhere to Store KeyWhy
ApolloClay Settings > Connections0 credits when using own key
ClearbitClay Settings > Connections0 credits when using own key
Hunter.ioClay Settings > Connections0 credits when using own key
HubSpotClay Settings > ConnectionsCRM sync uses Clay's OAuth
SalesforceClay Settings > ConnectionsCRM sync uses Clay's OAuth
Step 4: API Key Rotation Procedure
bash
# 1. Generate new key in Clay Settings > API
# 2. Update all integrations with new key
# 3. Test connectivity
curl -s -X POST "https://api.clay.com/v1/people/enrich" \
  -H "Authorization: Bearer $NEW_CLAY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"email": "test@example.com"}' | jq .status

# 4. Once confirmed working, revoke old key in Clay dashboard
# 5. Update deployment secrets
gh secret set CLAY_API_KEY --body "$NEW_CLAY_API_KEY"
Step 5: Protect Enriched Lead Data
typescript
// src/clay/data-protection.ts
const PII_FIELDS = ['email', 'phone', 'personal_email', 'home_address', 'linkedin_url'];

/** Strip PII from enriched data before logging or analytics */
function redactPII(row: Record<string, unknown>): Record<string, unknown> {
  const redacted = { ...row };
  for (const field of PII_FIELDS) {
    if (field in redacted) {
      redacted[field] = '[REDACTED]';
    }
  }
  return redacted;
}

/** Hash email for deduplication without storing plaintext */
function hashEmail(email: string): string {
  return crypto.createHash('sha256').update(email.toLowerCase().trim()).digest('hex');
}

// Usage: log enriched data safely
console.log('Enriched:', redactPII(enrichedRow));
Step 6: Security Checklist
  • API keys stored in environment variables or secrets manager
  • .env files in .gitignore
  • Webhook callback endpoints validate request signatures
  • Provider API keys connected in Clay UI (not in application code)
  • API key rotation procedure documented and tested
  • Enriched PII data redacted in application logs
  • Clay workspace uses separate API keys per integration
  • Least privilege: viewers can't run enrichments or export data
  • No hardcoded Clay URLs or keys in source code
  • git-secrets or similar scanning enabled in CI
Show full SKILL.md (176 more words)Show less

Error Handling

Security IssueDetectionMitigation
API key in git historygit log -p --all -S 'clay_ent_'Rotate key immediately, use BFG to scrub
Unauthorized webhook callsMissing signature validationAdd HMAC verification middleware
Over-permissioned usersViewers running enrichmentsAudit roles in Settings > Members
PII in application logsgrep logs for email patternsAdd PII redaction to log pipeline

Output

Maintain a security-control record with secret references and owners, effective roles, callback authentication result, PII logging/redaction evidence, rotation date, incident route, and approved exceptions. Never include live tokens, webhook secrets, raw enrichment records, or audit-export contents in this record or its supporting logs.

Examples

Rotate a staging key through the secret manager, confirm the service restarts with the new reference, and prove that a callback with an invalid signature is rejected without logging its body. If a key or PII appears in history/logs, revoke or contain it, follow the incident process, and verify the corrective control before re-enabling the integration.

Resources

Next Steps

For production deployment, see clay-prod-checklist.

© jeremylongshore, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in skills/.curated/clay-security-basics of jeremylongshore/tons-of-skills-marketplace.

Open the folder on GitHubat commit cfae287

Compare with similar skills

Clay Security Basics next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Clay Security Basics compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Clay Security Basics this skilljeremylongshore/tons-of-skills-marketplace2.8k—~1.7kAutomated safety check: NotesMIT
Sec Checkwaynesutton/markdown-site627—~753Automated safety check: PassMIT
Security Reviewtrycompai/comp2k—~853Automated safety check: PassAGPL-3.0
Security ConvexIgorWarzocha/Opencode-Workflows122—~3.1kAutomated safety check: PassNone
Django Access Reviewgetsentry/skills1k3 repos~2.6kAutomated safety check: NotesApache-2.0
API Route Patternsbybren-llc/safe-agentic-workflow423—~1.6kAutomated safety check: PassMIT

Similar skills

  • Sec Check

    waynesutton/markdown-site

    Security review checklist for Convex functions, auth logic, public queries, admin routes, webhooks, uploads, and AI-generated code.

    627 GitHub stars~753 tokensUpdated 4 mo ago
    Backend & APIsAuto-check passed

  • Security Review

    trycompai/comp

    Check code for the most common, high-risk security vulnerabilities (broken access control, tenant isolation, injection, secrets, SSRF, auth/session, unsafe file handling, mass assignment) before it…

    2k GitHub stars~853 tokensUpdated yesterday
    SecurityAuto-check passed

  • Security Convex

    IgorWarzocha/Opencode-Workflows

    Review Convex security audit patterns for authentication and authorization.

    122 GitHub stars~3.1k tokensUpdated 8 mo ago
    SecurityAuto-check passed

  • Django Access Review

    getsentry/skills

    Official

    Django access control and IDOR security review. An agent skill from getsentry/skills.

    1k GitHub starsUsed in 3 repos~2.6k tokens
    Backend & APIsAuto-check: notes

  • API Route Patterns

    bybren-llc/safe-agentic-workflow

    API route implementation patterns with RLS, validation, and error handling. Use when creating API routes, implementing CRUD endpoints, adding server-side…

    423 GitHub stars~1.6k tokensUpdated 2 mo ago
    Backend & APIsAuto-check passed

  • Cb Security Hardening

    BlkLeg/CircuitBreaker

    Enforces Circuit Breaker security hardening conventions across backend, frontend, Docker, and nginx.

    201 GitHub stars~2.1k tokensUpdated 5 days ago
    Backend & APIsAuto-check passed

More from jeremylongshore/tons-of-skills-marketplace

All 3,342 skills in this repo

  • Performing Security Code Review

    jeremylongshore/tons-of-skills-marketplace

    Execute this skill enables AI assistant to conduct a security-focused code review using the security-agent plugin.

    2.8k GitHub starsUsed in 2 repos~1.3k tokens
    Auto-check: notes

  • Adapting Transfer Learning Models

    jeremylongshore/tons-of-skills-marketplace

    Build this skill automates the adaptation of pre-trained machine learning models using transfer learning techniques.

    2.8k GitHub stars~1.1k tokensUpdated today
    Auto-check passed

  • Agent Context Loader

    jeremylongshore/tons-of-skills-marketplace

    Execute proactive auto-loading: automatically detects and loads agents.md files.

    2.8k GitHub stars~1.1k tokensUpdated today
    Auto-check passed

  • Aggregating Performance Metrics

    jeremylongshore/tons-of-skills-marketplace

    Aggregate and centralize performance metrics from applications, systems, databases, caches, and services.

    2.8k GitHub stars~1.2k tokensUpdated today
    Auto-check passed

  • Analyzing Capacity Planning

    jeremylongshore/tons-of-skills-marketplace

    Execute this skill enables AI assistant to analyze capacity requirements and plan for future growth.

    2.8k GitHub stars~947 tokensUpdated today
    Auto-check passed

  • Analyzing Database Indexes

    jeremylongshore/tons-of-skills-marketplace

    Process use when you need to work with database indexing. An agent skill from jeremylongshore/tons-of-skills-marketplace.

    2.8k GitHub stars~2k tokensUpdated today
    Auto-check passed

Categories

Questions about Clay Security Basics

What does Clay Security Basics do?

Apply Clay security best practices for API keys, webhook secrets, and data access control. Clay Security Basics is an agent skill from jeremylongshore/tons-of-skills-marketplace. Apply Clay security best practices for API keys, webhook secrets, and data access control.

When should I use Clay Security Basics?

Clay Security Basics fits situations like: securing Clay integrations; rotating API keys; auditing access; implementing webhook authentication.

How do I install Clay Security Basics in Claude Code?

Run `npx skills add jeremylongshore/tons-of-skills-marketplace --skill clay-security-basics -a claude-code`. Or copy the skill folder (skills/.curated/clay-security-basics in jeremylongshore/tons-of-skills-marketplace) into .claude/skills/clay-security-basics in your project. Claude Code loads it when a task matches its description.

How do I install Clay Security Basics in Codex?

Run `npx skills add jeremylongshore/tons-of-skills-marketplace --skill clay-security-basics -a codex`. Or copy the skill folder (skills/.curated/clay-security-basics in jeremylongshore/tons-of-skills-marketplace) into .agents/skills/clay-security-basics in your project. Codex loads it when a task matches its description.

Can I use Clay Security Basics in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add jeremylongshore/tons-of-skills-marketplace --skill clay-security-basics -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/clay-security-basics, .gemini/skills/clay-security-basics, .github/skills/clay-security-basics and .opencode/skills/clay-security-basics in your project.

What does Clay Security Basics need to run?

Going by SKILL.md and its folder, Clay Security Basics needs the command-line tools its instructions call (gh, gcloud, aws, curl, jq and git) and credentials named CLAY_WEBHOOK_SECRET, CLAY_API_KEY and NEW_CLAY_API_KEY. Our summary lists: A credential in CLAY_API_KEY; A credential in CLAY_WEBHOOK_SECRET. Its frontmatter pre-approves these tools: Read, Write, Edit, Grep. Compatibility (from SKILL.md): Designed for Claude Code.

Does Clay Security Basics access the network?

SKILL.md names 3 domains. In commands or code: api.clay.com; the agent is likely to contact it when it follows the instructions. As links in the text: university.clay.com and owasp.org. This is read from the text; nothing was executed.

Is Clay Security Basics safe to install?

Our automated static check of SKILL.md found notes only (mentions a .env file), nothing it rates as a warning. It is not a guarantee. Review the folder before installing.

What licence does Clay Security Basics use?

Clay Security Basics is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Clay Security Basics use?

About 1.7k tokens (SKILL.md is roughly 6.7k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Clay Security Basics?

Skills that share tags, products or a category with Clay Security Basics: Sec Check (waynesutton/markdown-site, 627 stars), Security Review (trycompai/comp, 2k stars), Security Convex (IgorWarzocha/Opencode-Workflows, 122 stars) and Django Access Review (getsentry/skills, 1k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Clay Security Basics?

jeremylongshore (a GitHub user) maintains it in jeremylongshore/tons-of-skills-marketplace, which has 2,827 GitHub stars. The repository holds 3,342 skills in this directory. The repository was last updated on October 10, 2026.

Source: jeremylongshore/tons-of-skills-marketplace on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.