security-and-hardening

Hardens code against vulnerabilities. Use when handling user input, authentication, data storage, or external integrations. Use when building any feature that accepts untrusted data, manages user sessions, or interacts with third-party services. Use when personal data or privacy compliance (GDPR, CCPA) is involved.

Quality

71%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/security-and-hardening/SKILL.md

Quality

Content

56%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with concrete, executable security code and useful validation checklists, but it is over-long for a SKILL.md and undermines its own progressive disclosure by repeatedly pointing to a `references/security-checklist.md` that is absent from the bundle.

Suggestions

Create the missing references/security-checklist.md referenced on lines 77, 303, and 451 (OWASP 2021 ordering, package-manager matrix, pre-commit verification steps), or remove the dangling ../../references/security-checklist.md pointers so navigation is not broken.

Move the bulk OWASP Top 10 code patterns and the Security Review Checklist into the referenced file so SKILL.md stays a lean overview with one-level-deep references, improving both conciseness and progressive disclosure.

Trim rhetorical framing (e.g. "every secret as sacred", "Security isn't a phase") and condense the large Common Rationalizations table to reduce token load while retaining the actionable checklists and code.

Dimension	Reasoning	Score
Conciseness	The body is mostly efficient actionable reference material (code, tables, checklists), but includes rhetorical framing ("every secret as sacred", "Security isn't a phase") and a large Common Rationalizations table that could be trimmed, fitting the "mostly efficient but includes some unnecessary explanation or could be tightened" anchor at 3 rather than the minor-trims-only anchor at 4.	3 / 5
Actionability	It provides extensive copy-paste-ready TypeScript covering the common cases (parameterized queries, bcrypt hashing, httpOnly/secure/sameSite session config, DOMPurify XSS handling, owner-scoped access-control checks, helmet/CSP/CORS, SSRF host allowlist with DNS-resolution checks, zod boundary schemas, rate limiting), fitting the fully-executable anchor at 5.	5 / 5
Workflow Clarity	The "Process: Threat Model First" section gives a clear 4-step sequence and both the Security Review Checklist and final Verification section provide explicit validation checkpoints, fitting the "clear sequence with most checkpoints present" anchor at 4; not 5 because the skill is reference-shaped rather than a single fragile workflow with explicit validate→fix→retry feedback loops.	4 / 5
Progressive Disclosure	Headers give reasonable structure and references to `../../references/security-checklist.md` are clearly signaled, but that referenced file does not exist (no references/ directory is present) and the ~500-line body inlines bulk OWASP patterns and checklists that belong in separate files, fitting the "some structure but content that should be separate is inline" anchor at 3 rather than the well-split anchor at 4.	3 / 5
	Total	15 / 20 Passed

Description

86%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, trigger-rich description that explicitly answers both what the skill does and when to use it, with comprehensive natural-language trigger terms and synonyms. The only weakness is that the "what" states a single action ("hardens code") rather than enumerating the concrete hardening actions the skill actually covers.

Dimension	Reasoning	Score
Specificity	"Hardens code against vulnerabilities" names the security domain plus one concrete action ("hardens code"), but does not enumerate multiple specific hardening actions, matching the "names domain and 1-2 concrete actions, not comprehensive" anchor rather than the multi-action anchor at 4.	3 / 5
Completeness	It explicitly states the "what" ("Hardens code against vulnerabilities") and follows with three explicit "Use when..." clauses carrying concrete trigger phrases, satisfying the both-what-and-when-with-concrete-triggers anchor at 5; not 4 because the "when" is explicit and specific rather than only weakly present.	5 / 5
Trigger Term Quality	The description covers natural trigger terms and their synonyms comprehensively — "user input", "untrusted data", "authentication", "user sessions", "external integrations", "third-party services", "personal data", "privacy compliance (GDPR, CCPA)" — phrases a user would naturally say, fitting the comprehensive-coverage anchor at 5 rather than the few-terms-missing anchor at 4.	5 / 5
Distinctiveness Conflict Risk	The security-hardening niche is clear with distinctive triggers (GDPR/CCPA, untrusted data, authentication), but the broad "building any feature that accepts untrusted data" framing carries minor overlap risk with closely related general development skills, fitting the "mostly distinct; minor overlap risk" anchor at 4 rather than the minimal-conflict anchor at 5.	4 / 5
	Total	17 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: addyosmani/agent-skills
Path: skills/security-and-hardening/SKILL.md
Commit: df1edb2

Reviewed: about 19 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.