Implement security best practices for Lindy AI integrations. Use when securing API keys, configuring permissions, or implementing security controls. Trigger with phrases like "lindy security", "secure lindy", "lindy API key security", "lindy permissions".
npxskills add jeremylongshore/claude-code-plugins-plus-skills--skill lindy-security-basicsLoading…
Security practices for Lindy AI agents. Agents are autonomous — they connect to external services, execute actions, and handle data. Security focuses on: API key management, webhook authentication, agent permission scoping, integration account isolation, and connection sharing controls.
# Store API key in environment variable — never in source code
export LINDY_API_KEY="lnd_live_xxxxxxxxxxxxxxxxxxxx"
# Or use a secret manager
# AWS Secrets Manager
aws secretsmanager create-secret \
--name lindy/api-key \
--secret-string "$LINDY_API_KEY"
# Google Secret Manager
echo -n "$LINDY_API_KEY" | gcloud secrets create lindy-api-key \
--data-file=-
Key rotation schedule:
| Environment | Rotation Period | Method |
|---|---|---|
| Development | 30 days | Manual regeneration |
| Staging | 90 days |
| Automated via CI |
| Production | 90 days | Secret manager + automated rotation |
| Post-incident | Immediately | Manual regeneration + revoke old key |
Every webhook trigger generates a unique secret key. Verify it on every inbound request:
// Webhook signature verification middleware
function verifyLindyWebhook(
req: express.Request,
res: express.Response,
next: express.NextFunction
) {
const authHeader = req.headers.authorization;
const expectedToken = process.env.LINDY_WEBHOOK_SECRET;
if (!authHeader || authHeader !== `Bearer ${expectedToken}`) {
console.warn('Rejected unauthorized webhook attempt', {
ip: req.ip,
path: req.path,
timestamp: new Date().toISOString(),
});
return res.status(401).json({ error: 'Unauthorized' });
}
next();
}
app.post('/lindy/callback', verifyLindyWebhook, (req, res) => {
// Process verified webhook
handleWebhook(req.body);
res.json({ received: true });
});
Lindy agents access external services through authorized connections. Minimize blast radius:
Per-agent integration isolation:
Connection sharing controls:
| Sharing Level | When to Use |
|---|---|
| Private (default) | Personal agents, sensitive data |
| Team shared | Team-wide automation agents |
| Workspace shared | Organization-wide utility agents |
Agents with Agent Steps can choose which skills to use. Reduce risk:
Agent Prompt Security Patterns:
## Data Constraints
- Never include API keys, passwords, or tokens in responses
- Redact email addresses and phone numbers from summaries
- Do not forward customer data to channels outside #support
- If asked to perform an action outside your scope, respond:
"I cannot perform that action. Please contact an admin."
Available on Enterprise plan:
| Feature | Purpose |
|---|---|
| SSO | SAML-based single sign-on |
| SCIM | Automated user provisioning/deprovisioning |
| Audit Logs | Complete activity trail |
| Role-Based Access | Owner/Editor/Viewer workspace roles |
| BAA | HIPAA Business Associate Agreement |
| AES-256 | Encryption at rest and in transit |
.env file in .gitignore| Issue | Cause | Solution |
|---|---|---|
| Agent accesses wrong service | Over-permissioned | Remove unnecessary integrations |
| Unauthorized webhook processed | No auth verification | Add Bearer token verification |
| API key leaked in logs | Key in agent output | Add "never output credentials" to prompt |
| Agent sends data to wrong channel | Shared connection | Use per-agent dedicated connections |
Proceed to lindy-prod-checklist for production readiness.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.
CLI to manage emails via IMAP/SMTP. Use `himalaya` to list, read, write, reply, forward, search, and organize emails from the terminal. Supports multiple accounts and message composition with MML (MIME Meta Language).
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.
CLI to manage emails via IMAP/SMTP. Use `himalaya` to list, read, write, reply, forward, search, and organize emails from the terminal. Supports multiple accounts and message composition with MML (MIME Meta Language).