From clari-pack
Secures Clari API tokens using AWS Secrets Manager, redacts PII from forecast exports in Python, and applies access control checklists.
npx claudepluginhub jeremylongshore/claude-code-plugins-plus-skills --plugin clari-packThis skill is limited to using the following tools:
Secure your Clari integration: API token management, exported data PII handling, and access control best practices.
Configures Clari API key authentication, environment setup, and connectivity tests for forecast data exports to Snowflake, BigQuery, or Redshift.
Secures Clay integrations with API key storage in secrets managers, webhook signature verification via Node.js middleware, and provider credential isolation.
Secures ClickUp API tokens with .env storage, git pre-commit hooks, rotation via curl/gh/vault/aws, and least-privilege OAuth scopes in TypeScript.
Share bugs, ideas, or general feedback.
Secure your Clari integration: API token management, exported data PII handling, and access control best practices.
# Store token in secrets manager
aws secretsmanager create-secret \
--name "clari/prod/api-token" \
--secret-string "${CLARI_API_KEY}"
# In CI/CD, load from secrets
export CLARI_API_KEY=$(aws secretsmanager get-secret-value \
--secret-id "clari/prod/api-token" --query SecretString --output text)
Rotation: Clari API tokens are generated per-user. To rotate, generate a new token in User Settings, update all consumers, then discard the old one.
Clari export data contains PII (rep names, emails, deal amounts):
def redact_pii(entries: list[dict]) -> list[dict]:
"""Redact PII from forecast entries for non-production use."""
import hashlib
redacted = []
for entry in entries:
r = entry.copy()
if "ownerEmail" in r:
r["ownerEmail"] = hashlib.sha256(
r["ownerEmail"].encode()
).hexdigest()[:12] + "@redacted"
if "ownerName" in r:
r["ownerName"] = f"Rep-{hashlib.sha256(r['ownerName'].encode()).hexdigest()[:6]}"
redacted.append(r)
return redacted
.env files in .gitignoreFor production deployment, see clari-prod-checklist.