Skill Security ב-Automations ל-Claude

מתי להשתמש

"Security", "API key leaked", "Secrets management", "Compliance", "GDPR", "Audit log".

הוראות עבודה

1. Top Security Risks

א. Leaked API Keys

• Hardcoded in workflows.
• Visible in logs.
• Shared in screenshots.

ב. Excessive Permissions

• API key with admin access for read-only need.
• OAuth scope = full instead of minimal.

ג. Data Leaks

• PII to external services.
• Logs containing sensitive data.
• Workflow outputs to wrong destination.

ד. Webhook Abuse

• Unsigned webhooks.
• Anyone can POST.

ה. Audit Gaps

• No record of who changed what.

2. API Key Management

Best Practices

• Use built-in credentials (Zapier/Make/n8n have encrypted storage).
• Never in plain code/notes.
• Rotate every 90 days minimum.
• Separate keys per environment (dev/staging/prod).
• Minimal scope — read-only when possible.

Secrets Vaults

• AWS Secrets Manager.
• HashiCorp Vault.
• 1Password Business.
• Doppler.

3. OAuth Best Practices

Scopes

• Request minimum needed.
• "Send email" not "manage account".
• Review scopes annually.

Token Refresh

• Auto-refresh tokens.
• Alert on refresh failures.

Revocation

• When team member leaves → revoke their tokens.

4. Webhook Security

Verify Signatures (HMAC)

• Service signs payload with shared secret.
• You verify on receipt.
• Reject if signature invalid.

IP Whitelisting (where supported)

• Only accept from known IPs.

Rate Limiting

• Prevent abuse.

5. Data Protection

PII Handling

• Identify: emails, names, phones, IDs.
• Minimize: only what's needed.
• Encrypt: in transit (HTTPS) + at rest.
• Retention: delete after use.

Hebrew/Israeli PII

• ת.ז. (Israeli ID): especially sensitive.
• כתובת: home addresses.
• Health data: medical records.

6. GDPR Compliance

Required

• Lawful basis for processing (consent, contract, legitimate interest).
• Data Processing Agreements (DPAs) with vendors.
• Right to erasure — deletion workflow.
• Right to access — data export.
• Breach notification — 72 hours.

Tools' DPAs

• Zapier, Make, n8n all GDPR-compliant.
• Sign DPA at enterprise plans.

7. Israeli Privacy Law (PPL Amendment 13)

Effective 2025+

• Stricter than old law.
• Aligns with GDPR.
• Israeli Privacy Authority (הרשות להגנת הפרטיות) enforcement.

Requirements

• Privacy Policy clear.
• Consent for marketing.
• Data minimization.
• Breach notification.

8. Audit Logging

What to Log

• Who (user/system).
• What (action: created/modified/deleted).
• When (timestamp).
• Where (workflow/object).
• Result (success/failure).

Retention

• 1-7 years (depending on regulation).

Tools

• Splunk, Datadog, AWS CloudWatch.
• Built-in (Zapier audit log on Enterprise).

9. Sample Security Workflow

Setup:
1. All credentials in Vault (1Password / AWS Secrets).
2. Workflows reference Vault, not hardcoded.
3. Quarterly access review.

On change:
1. Workflow modified → Audit log entry.
2. Critical workflow change → Slack notification to security team.
3. Test in staging before prod.

On breach suspicion:
1. Disable affected workflow.
2. Rotate all keys.
3. Review logs for unauthorized access.
4. Notify Privacy Authority (if PII breach > 1,000 records).

10. Common Pitfalls

❌ API keys in plain text notes. ❌ OAuth full scope by default. ❌ No DPAs with vendors. ❌ Logs contain passwords/PII. ❌ No quarterly access review. ❌ Webhooks ללא HMAC.

11. Israel Specifics

• PPL 2024+ stricter than before.
• Reservist data sensitive.
• Defense industry = special compliance.
• Israeli Privacy Authority active enforcement.

12. אסיים בהמלצה.

קלט נדרש

פלט צפוי

דגלים אדומים

• 🚨 Hardcoded API keys — leak risk.
• 🚨 No HMAC on webhooks — abuse risk.
• 🚨 Logs contain PII — privacy violation.
• 🚨 No DPAs signed — GDPR violation.

הערות חשובות

• Compliance lawyer for serious cases.
• SOC 2 for B2B SaaS critical.
• Israeli PA can fine ₪320K+ for breaches.

פרומפט לדוגמה

Israeli SaaS, customer PII in workflows. Compliance plan.

API key suspect leaked. Incident response steps.

SOC 2 prep — automation aspects.

© 2026 Automation Expert Pro | גרסה 1.0.0