security-patterns

Implements authentication, authorization, encryption, secrets management, and security hardening patterns. Use when designing auth flows, managing secrets, configuring CORS, implementing rate limiting, or when asked about JWT, OAuth, password hashing, API keys, RBAC, or security best practices.

Quality

90%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

80%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable and token-efficient, with executable code and minimal fluff. Its weaknesses are the lack of validation checkpoints/feedback loops in the implementation workflow and the absence of progressive disclosure — all content is inline in one large file.

Suggestions

Add explicit validation checkpoints and a fix→retry feedback loop to the Security Implementation Workflow (e.g., 'Verify token verification rejects expired/tampered tokens; if a test fails, fix and re-run'), so workflow_clarity can reach the top anchor.

Split the large body into one-level-deep reference files (e.g. references/authentication.md, references/encryption.md) and keep SKILL.md as an overview with clearly signaled links, to improve progressive_disclosure for a skill of this size.

Remove or trim the final 'Common Anti-Patterns Summary' table where it duplicates the inline WRONG/CORRECT annotations, keeping only items not already covered inline.

Dimension	Reasoning	Score
Conciseness	Prose is lean throughout — terse "WRONG: ... \| CORRECT: ..." annotations and executable code with no explanations of concepts Claude already knows; the only redundancy is the final anti-patterns summary table that restates earlier sections, but every other token earns its place.	3 / 3
Actionability	Provides fully executable, copy-paste-ready TypeScript/Python for JWT signing/verification, RBAC middleware, bcrypt hashing, AES-256-GCM encryption, CORS, rate limiting, helmet, and zod validation — matching the anchor for specific, complete examples.	3 / 3
Workflow Clarity	The 8-step "Security Implementation Workflow" checklist gives a clear sequence and a final "Validate against anti-patterns checklist" step, but it lacks explicit validation checkpoints and feedback loops between steps, so checkpoints remain implicit rather than enforced.	2 / 3
Progressive Disclosure	Sections are well-organized by topic, but the ~480-line skill is a single monolithic file with no external references or bundle files; for a skill this large, pattern details (e.g. auth, encryption, CORS) would be better split into one-level-deep reference files.	2 / 3
	Total	10 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, complete, and rich in natural trigger terms with a clear explicit "Use when" clause, occupying a distinct security niche. It matches the strongest reference examples closely.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete capability domains — "authentication, authorization, encryption, secrets management, and security hardening patterns" — matching the anchor for enumerating several specific actions rather than vague language.	3 / 3
Completeness	Explicitly states both what it does ("Implements authentication, authorization, encryption...") and when to use it ("Use when designing auth flows..."), satisfying both halves with an explicit trigger clause.	3 / 3
Trigger Term Quality	The "Use when..." clause covers natural terms users actually say — "auth flows", "CORS", "rate limiting", "JWT", "OAuth", "password hashing", "API keys", "RBAC" — giving broad coverage of likely phrasings.	3 / 3
Distinctiveness Conflict Risk	The security niche is sharply defined by distinct triggers (JWT, OAuth, RBAC, CORS, encryption, secrets), making it unlikely to fire for unrelated skills.	3 / 3
	Total	12 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: CloudAI-X/claude-workflow-v2
Path: skills/security-patterns/SKILL.md
Commit: 4c242af

Reviewed: about 16 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.