Agent-Skills.md

Agent Skills: Attio Verified First Read

'Make your first Attio API calls -- list objects, create a person,

UncategorizedID: jeremylongshore/claude-code-plugins/attio-hello-world

Repository

jeremylongshore/claude-code-plugins
jeremylongshoreLicense: MIT
2,458348

Install this agent skill to your local

pnpm dlx add-skill https://github.com/jeremylongshore/claude-code-plugins-plus-skills/tree/HEAD/plugins/saas-packs/attio-pack/skills/attio-hello-world

Skill Files

Browse the full folder contents for attio-hello-world.

Download Skill

Loading file tree…

plugins/saas-packs/attio-pack/skills/attio-hello-world/SKILL.md

Skill Metadata

Name
attio-hello-world
Description
>-

Attio Verified First Read

Overview

This skill proves authentication, workspace reachability, JSON parsing, and object discovery with one read-only request. It does not create a demonstration contact in a real CRM.

Prerequisites

  • A named repository and non-production or approved workspace
  • A single-workspace access token or OAuth access token
  • The object_configuration:read scope required by the object-list endpoint
  • A runtime with HTTPS and JSON support

Tool Discipline

Use Read, Glob, and Grep to inspect the local client, environment-variable names, and tests. Use WebFetch only for current official Attio documentation. Use Write or Edit after confirming the repository and intended implementation file.

Current Contract

  • Base URL: https://api.attio.com/v2.
  • Send Authorization: Bearer <access_token>; Bearer authentication is the recommended form.
  • Start with GET /v2/objects and validate a { data: [...] } response.
  • Keep the credential out of source, output, exceptions, and request logging.

Authentication

Use a workspace API key for a single workspace or OAuth for an app serving multiple workspaces. Do not request write scopes for this proof.

Instructions

  1. Confirm the repository, runtime, workspace alias, secret source, and granted scope.
  2. Add or inspect a tiny request wrapper with explicit base URL and Bearer header injection.
  3. Request /objects with a bounded timeout and capture status plus content type.
  4. On success, parse data and record only object slugs or counts that are safe to expose.
  5. Assert that at least one expected object is visible to the workspace.
  6. Add a fixture test for success plus 401, 403, and non-JSON failure handling.

Approval Boundaries

Do not add create, update, assert, or delete calls to the first-read proof. Never print the access token or persist a raw workspace response.

Output

Return the redacted configuration, status, response-envelope assertion, safe object summary, fixture-test result, and next integration boundary.

Error Handling

| Condition | Response | |---|---| | 401 | Verify credential injection and replace an invalid token. | | 403 | Confirm object_configuration:read without broadening other scopes. | | Non-JSON response | Preserve status/content type and stop parsing. | | Unexpected workspace data | Stop and verify workspace identity. |

Examples

Input:

workspace=development; request=GET /v2/objects; writes=forbidden

Expected handoff:

auth=pass; envelope=pass; expected-object=present; secrets-exposed=0

Resources