Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →Apply Flexport API security best practices including webhook signature verification, API key rotation, and least-privilege access patterns. Trigger: "flexport security", "flexport webhook signature", "secure flexport API key".
.claude/skills/jeremylongshore-flexport-security-basics/SKILL.md| Test case | Without → With | Effect | Δ tokens | Δ turns |
|---|---|---|---|---|
| case-02 | ✗→✓ | ▲ Improved | 4% | 0% |
| case-05 | ✗→✓ | ▲ Improved | 32% | 0% |
| case-06 | ✗→✓ | ▲ Improved | -5% | 0% |
| case-09 | ✗→✓ | ▲ Improved | 26% | 0% |
| case-10 | ✗→✓ | ▲ Improved | 9% | 0% |
Protect four high-value boundaries: OAuth/API credentials, cached tokens, webhook secrets/raw bodies, and business mutations that can create freight or trade records.
Prefer distinct endpoint-scoped OAuth clients. Treat API keys as broad-access exceptions and never record secret values or suffixes.
Request with the documented audience/grant, cache encrypted 24-hour JWTs, single-flight refresh, and never pass tokens through browser state or logs.
Verify raw-body HMAC-SHA256 from X-Hub-Signature-256, reject malformed/length-mismatched values, then parse and enqueue.
Allow documented Flexport hosts, validate schemas and sizes, preserve opaque IDs, and reject unexpected mutation intent.
Require business authorization, durable operation keys, one writer, and reconciliation before retrying bookings or record creation.
Test credential revocation, webhook secret rotation, log leakage, provider outage, and rollback with metadata-only evidence.
REST calls authenticate with a cached OAuth 2.0 client-credentials Bearer token using audience https://api.flexport.com, or an explicitly accepted broad API key. Use distinct credentials per workload and never log credentials or tokens. MCP calls use the authenticated connection to https://mcp.flexport.com/mcp and remain subject to each tool's documented account permissions.
Use Read and Grep for discovery and evidence. Use Write or Edit only for the approved artifact, code, configuration, test, or receipt described by this workflow; do not make an unapproved Flexport-side change.
Return a machine-reviewable receipt in this shape; adapt the operation values, but never place credentials or provider payloads in it:
yamlsurface: rest-v3 operation: shipment-read decision: approved outcome: verified evidence: release_sha: recorded-out-of-band provider_reference: redacted rollback_owner: logistics-platform
A shipment reader and invoice importer use different scoped OAuth clients. A leaked client triggers revocation and replacement of only that workload, while webhook processing remains isolated behind its own secret.
| Failure | Response | | --- | --- | | Credential committed or logged | Revoke/rotate, contain the artifact, and repair injection/redaction. | | Signature checked after JSON parsing | Reject the implementation and restore raw-body verification. | | Broad key used by many workloads | Segment and migrate to scoped clients. | | Uncertain booking retry requested | Block it until provider state is reconciled. |
| Case | Status | Duration (ms) | Turns | Tokens | Tool calls | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Without | With | Δ | Without | With | Δ | Without | With | Δ | Without | With | Δ | ||
case-01 | fail→fail | 14,145 | 17,034 | +20% | 1 | 1 | 0% | 2,786 | 3,377 | +21% | 0 | 0 | — |
case-02 | fail→pass | 16,343 | 17,707 | +8% | 1 | 1 | 0% | 3,421 | 3,565 | +4% | 0 | 0 | — |
case-03 | fail→fail | 22,014 | 19,022 | -14% | 1 | 1 | 0% | 3,580 | 3,937 | +10% | 0 | 0 | — |
case-04 | pass→pass | 18,417 | 14,149 | -23% | 1 | 1 | 0% | 2,514 | 2,646 | +5% | 0 | 0 | — |
case-05 | fail→pass | 16,289 | 14,025 | -14% | 1 | 1 | 0% | 1,932 | 2,558 | +32% | 0 | 0 | — |
case-06 | fail→pass | 8,464 | 8,396 | -1% | 1 | 1 | 0% | 1,540 | 1,460 | -5% | 0 | 0 | — |
case-07 | pass→pass | 7,009 | 2,394 | -66% | 1 | 1 | 0% | 1,140 | 1,478 | +30% | 0 | 0 | — |
case-08 | pass→pass | 10,556 | 4,159 | -61% | 1 | 1 | 0% | 1,839 | 1,661 | -10% | 0 | 0 | — |
case-09 | fail→pass | 12,661 | 15,180 | +20% | 1 | 1 | 0% | 2,411 | 3,032 | +26% | 0 | 0 | — |
case-10 | fail→pass | 34,844 | 14,134 | -59% | 1 | 1 | 0% | 2,458 | 2,670 | +9% | 0 | 0 | — |
case-11 | fail→pass | 7,176 | 9,535 | +33% | 1 | 1 | 0% | 1,171 | 1,765 | +51% | 0 | 0 | — |
case-12 | fail→pass | 9,165 | 7,651 | -17% | 1 | 1 | 0% | 1,532 | 1,502 | -2% | 0 | 0 | — |
case-13 | fail→fail | 22,643 | 17,916 | -21% | 1 | 1 | 0% | 3,213 | 3,529 | +10% | 0 | 0 | — |
case-14 | pass→pass | 13,471 | 11,163 | -17% | 1 | 1 | 0% | 2,188 | 2,810 | +28% | 0 | 0 | — |
case-15 | pass→pass | 18,586 | 16,786 | -10% | 1 | 1 | 0% | 2,331 | 2,967 | +27% | 0 | 0 | — |
case-16 | pass→pass | 19,894 | 16,679 | -16% | 1 | 1 | 0% | 2,614 | 3,309 | +27% | 0 | 0 | — |
case-17 | pass→pass | 10,063 | 9,190 | -9% | 1 | 1 | 0% | 1,727 | 1,689 | -2% | 0 | 0 | — |
case-18 | pass→pass | 15,383 | 13,893 | -10% | 1 | 1 | 0% | 2,651 | 3,287 | +24% | 0 | 0 | — |
case-19 | fail→fail | 19,991 | 14,597 | -27% | 1 | 1 | 0% | 3,112 | 2,848 | -8% | 0 | 0 | — |
case-20 | pass→pass | 11,334 | 9,263 | -18% | 1 | 1 | 0% | 2,416 | 3,093 | +28% | 0 | 0 | — |
case-21 | pass→pass | 12,548 | 17,068 | +36% | 1 | 1 | 0% | 2,520 | 3,572 | +42% | 0 | 0 | — |
case-22 | pass→pass | 13,081 | 12,570 | -4% | 1 | 1 | 0% | 1,897 | 2,783 | +47% | 0 | 0 | — |
case-23 | pass→pass | 21,642 | 9,478 | -56% | 1 | 1 | 0% | 2,017 | 1,983 | -2% | 0 | 0 | — |
DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 23 cases were attempted, and 22 counted toward the lift figure. The other 1 produced results that are not comparable between the two arms, so they are excluded from the headline rather than averaged into it. The headline lift of +30 percentage points is the difference between those two pass rates over the 22 comparable cases.
The publisher has shipped newer versions since this run, so these numbers describe v1, not the version currently listed.
Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.
Other measured skills in the registry, with their headline benchmark lift.