security-and-hardening

Hardens code against vulnerabilities. Use when handling user input, authentication, data storage, or external integrations. Use when building any feature that accepts untrusted data, manages user sessions, or interacts with third-party services. Use when auditing dependencies for known vulnerabilities, triaging package-manager audit findings, or assessing supply-chain risk in a new package. Use when personal data or privacy compliance (GDPR, CCPA) is involved.

Quality

86%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

81%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A thorough, highly actionable security skill with executable code, clear sequenced workflows, and explicit validation checkpoints for destructive and batch operations. Its main weakness is token efficiency from redundant restating across the checklist, verification, red-flags, and rationalizations sections, and content that is largely inlined rather than split into reference files.

Suggestions

Consolidate the overlapping Security Review Checklist, Verification, Red Flags, and Common Rationalizations sections into a single checklist to remove redundant restating and reclaim tokens.

Move the detailed pattern catalog (OWASP Top 10 Prevention Patterns, Input Validation, Rate Limiting examples) into a referenced reference file linked from the body, keeping SKILL.md as a leaner overview with quick-start examples.

Verify the referenced '../../references/security-checklist.md' is present in the bundle or adjust the path so the one-level-deep reference resolves within the skill's own directory.

Dimension	Reasoning	Score
Conciseness	Mostly high-signal and skill-specific (TOCTOU gaps, DNS rebinding, marker self-attestation) rather than generic concept explanation, but the ~520-line body restates similar points across the Security Review Checklist, Verification, Red Flags, and Common Rationalizations sections, and includes motivational prose ('Security isn't a phase — it's a constraint on every line of code') that could be tightened.	3 / 5
Actionability	Copy-paste-ready executable TypeScript examples with BAD/GOOD contrasts cover the common cases — parameterized queries, bcrypt hashing, session cookies, helmet/CSP/CORS, zod validation, SSRF allowlisting, rate limiting, and LLM output handling — with specific library calls and configuration values.	5 / 5
Workflow Clarity	Multi-step processes are clearly sequenced with explicit validation checkpoints: the four-step threat-model process, the dependency-triage decision tree, the supply-chain install-boundary sequence ('stop on disagreement or competing lockfiles'), and the destructive-operations sequence (resolve symlinks, verify allowlisted root + minimum depth + ownership before running), plus a final Verification checklist.	5 / 5
Progressive Disclosure	Good internal structure with clear section headers and a well-signaled one-level-deep reference to '../../references/security-checklist.md', but no bundle references/ directory exists in the skill to verify that file, and the bulk of detailed content is inlined in a single large file rather than appropriately split across reference files.	4 / 5
	Total	17 / 20 Passed

Description

91%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, trigger-rich description that clearly states what the skill does and gives multiple explicit 'Use when' clauses with natural, comprehensive keywords. The main weakness is a slightly abstract lead verb and broad opening domains that risk minor overlap with adjacent skills.

Dimension	Reasoning	Score
Specificity	Names the domain ('Hardens code against vulnerabilities') and several concrete activities ('auditing dependencies for known vulnerabilities, triaging package-manager audit findings, or assessing supply-chain risk'), but the lead verb 'hardens' is somewhat abstract and most of the description enumerates domains/scenarios rather than a comprehensive list of concrete actions.	4 / 5
Completeness	Explicitly answers both 'what' ('Hardens code against vulnerabilities') and 'when' with four concrete 'Use when...' trigger clauses covering input handling, untrusted-data features, dependency auditing, and privacy compliance.	5 / 5
Trigger Term Quality	Comprehensive natural-term coverage including 'user input', 'authentication', 'external integrations', 'untrusted data', 'user sessions', 'vulnerabilities', 'supply-chain risk', 'package-manager audit', and synonyms/acronyms like 'GDPR' and 'CCPA' that users would naturally say.	5 / 5
Distinctiveness Conflict Risk	Distinctive security niche with specific triggers (supply-chain risk, package-manager audit triage, GDPR/CCPA), but the broad opening domains ('user input, authentication, data storage, or external integrations') create minor overlap risk with general web-development or code-review skills.	4 / 5
	Total	18 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (525 lines); consider splitting into references/ and linking	Warning

	Total	15 / 16 Passed

Repository: addyosmani/agent-skills
Path: skills/security-and-hardening/SKILL.md
Commit: 48cb116

Reviewed: ~18 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.