Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →jeremylongshore/guidewire-security-and-rbac
Lock down a Guidewire Cloud API integration so it survives a SOC 2 audit, an NAIC Model Audit Rule review, and a real-world incident — least-privilege role design, encrypted committed secrets via SOPS+age, PII redaction in logs (SSN/DOB/claim narrative), audit-trail capture, cross-tenant isolation for multi-carrier integrations, and detect-and-rotate response to token leaks.
Passed 20 of 21 test cases with the skill, and 8 of 21 without it.
and 13 more in the full report
13 fixed8 passed either way1 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 12 test cases the skill fixed. Same model, same prompt, with and without the skill.
When redacting dates of birth from Guidewire claim and policy payload objects before logging, what format should the date of birth be transformed into?
| Checked | Without skill | With skill |
|---|---|---|
| Preserves only the birth year while masking month and day as YYYY-**-**. | Missed | Passed |
The instructions your model reads when the skill loads.
Build the security posture an integration needs in production: secrets that cannot leak from the repo, roles that cannot escalate beyond their job, logs that cannot exfiltrate PII, and an audit trail that satisfies SOC 2 and NAIC Model Audit Rule reviewers. This skill is the application of generic security practice to the specific shape of Guidewire Cloud API — claim and policy data carry regulated PII; a leaked client_secret can read or write a carrier's entire book of business; carriers operate under state-level insurance regulator scrutiny.
Five real-world failures this skill prevents:
.env in the repo — a git push to a public mirror leaks live credentials; the only defense is to never have plaintext in the tree, full stop.pc.account.write "to make development easier" and is never narrowed; the audit finding cites OWASP A01 broken access control.console.log(claim) dumps SSN, DOB, claim narrative, and phone numbers into the logging pipeline, where they replicate to every downstream tool the company uses.guidewire-install-auth and guidewire-sdk-patternssops and age installed locally (brew install sops age / apt install sops / mise install age)Build the posture in this order. Each layer addresses one of the five failures listed in Overview.
Plaintext .env files committed to a repo are the single largest source of credential leaks in the SaaS world. SOPS + age allows secrets to live in the repo as ciphertext that only holders of the age private key can read. The audit trail of "who rotated what when" comes free with git log.
sops-init # writes .sops.yaml + .env.sops + scripts/sops-env (idempotent)
sops secrets.prod.sops.yaml # interactive edit; saves re-encrypted
git add secrets.prod.sops.yaml && git commit -m "chore(secrets): rotate gw client secret"
In the runtime, decrypt via the anchored regex pattern (do not use the naive sed 's/^/export /' — see guidewire-install-auth for the bare-export-leak failure mode):
eval "$(sops -d secrets.prod.sops.yaml | sed -nE 's/^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/export \1=\2/p')"
test cases passed, vs 8 / 21 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.