hardening-user-privileges
Hardens CockroachDB user privileges by auditing and tightening role-based access control, reducing admin grants, restricting PUBLIC role permissions, and applying least-privilege principles. Use when reducing excessive privileges, cleaning up admin access, or implementing RBAC best practices.
90
88%
Does it follow best practices?
Impact
Pending
No eval scenarios have been run
Passed
No known issues
Quality
Discovery
100%Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.
This is an excellent skill description that clearly defines its scope (CockroachDB privilege hardening), lists specific concrete actions (auditing RBAC, reducing admin grants, restricting PUBLIC role), and includes an explicit 'Use when' clause with natural trigger terms. It is highly distinctive and would be easy for Claude to select appropriately from a large skill set.
| Dimension | Reasoning | Score |
|---|---|---|
Specificity | Lists multiple specific concrete actions: auditing role-based access control, tightening privileges, reducing admin grants, restricting PUBLIC role permissions, and applying least-privilege principles. | 3 / 3 |
Completeness | Clearly answers both 'what' (hardens CockroachDB user privileges by auditing RBAC, reducing admin grants, restricting PUBLIC role permissions) and 'when' (explicit 'Use when' clause covering reducing excessive privileges, cleaning up admin access, or implementing RBAC best practices). | 3 / 3 |
Trigger Term Quality | Includes strong natural keywords users would say: 'privileges', 'admin grants', 'RBAC', 'least-privilege', 'PUBLIC role', 'CockroachDB', 'access control'. These cover the domain well and match how users would describe their needs. | 3 / 3 |
Distinctiveness Conflict Risk | Highly distinctive with a clear niche: CockroachDB-specific privilege hardening and RBAC. The combination of CockroachDB + privilege hardening + RBAC makes it very unlikely to conflict with other skills. | 3 / 3 |
Total | 12 / 12 Passed |
Implementation
77%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
This is a well-structured, highly actionable skill with a clear multi-step workflow, explicit verification steps, and thoughtful safety considerations including rollback procedures. Its main weakness is moderate verbosity—some sections could be tightened without losing clarity—and the referenced bundle file (references/sql-queries.md) is missing, undermining the progressive disclosure structure.
Suggestions
Trim the 'When to Use This Skill' section to 2-3 items or remove it entirely since the header and description already convey the purpose.
Condense the Safety Considerations section—Claude understands the risks of revoking grants; focus on the critical rules (don't revoke last admin, create roles before revoking) rather than general advice about testing.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The skill is mostly efficient with concrete SQL examples, but includes some unnecessary explanation (e.g., the 'When to Use This Skill' section is somewhat redundant with the description, and the Safety Considerations section is verbose with guidance Claude could infer). The bullet lists evaluating admin users add useful context but could be tighter. | 2 / 3 |
Actionability | Every step includes fully executable SQL commands with clear context. The queries are copy-paste ready with appropriate placeholders (<app_db>, <username>), and the skill covers the complete workflow from audit through role creation, reassignment, revocation, verification, and rollback. | 3 / 3 |
Workflow Clarity | The 6-step workflow is clearly sequenced with a logical progression (audit → identify → create roles → reassign → revoke → verify). Step 6 provides explicit verification queries, the Safety Considerations section includes a clear incremental approach, and the Rollback section provides a feedback loop for error recovery. The ordering of 'create replacement roles first, then revoke' is a critical safety checkpoint that is well-emphasized. | 3 / 3 |
Progressive Disclosure | The skill references external files like 'references/sql-queries.md' and related skills, which is good structure. However, no bundle files were provided, so the referenced sql-queries.md doesn't exist. The main content is also quite long (~180 lines) and some sections like the detailed rollback examples and extensive documentation links could potentially be split out. | 2 / 3 |
Total | 10 / 12 Passed |
Validation
100%Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.
Validation — 11 / 11 Passed
Validation for skill structure
No warnings or errors.
- Repository
- cockroachlabs/cockroachdb-skills
- Commit
84bc1e4
- Reviewed
Table of Contents
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.