secure-code-guardian

Use when implementing authentication/authorization, securing user input, or preventing OWASP Top 10 vulnerabilities — including custom security implementations such as hashing passwords with bcrypt/argon2, sanitizing SQL queries with parameterized statements, configuring CORS/CSP headers, validating input with Zod, and setting up JWT tokens. Invoke for authentication, authorization, input validation, encryption, OWASP Top 10 prevention, secure session management, and security hardening. For pre-built OAuth/SSO integrations or standalone security audits, consider a more specialized skill.

Quality

93%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Failed to scan

The risk profile of this skill

Quality

Content

86%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured security skill with executable code, explicit constraints, and a clear workflow plus validation checklist. Minor gains are available by trimming the redundant Knowledge Reference list and adding an explicit validation retry loop.

Suggestions

Remove or condense the 'Knowledge Reference' keyword list—these are concepts Claude already knows and add token cost without guidance value.

Add an explicit validate→fix→retry feedback loop after the Validation Checkpoints (e.g., 'If a checkpoint fails, fix the control and re-verify before proceeding') to lift workflow_clarity to 5.

Tighten the generic 'Output Templates' section into a concrete deliverable checklist rather than restating high-level categories.

Dimension	Reasoning	Score
Conciseness	The code examples, constraints, and checkpoints are lean and earn their place, but the 'Knowledge Reference' keyword dump (OWASP Top 10, bcrypt/argon2, JWT, OAuth 2.0...) and the generic 'Output Templates' section restate concepts Claude already knows.	4 / 5
Actionability	Fully executable, copy-paste-ready TypeScript examples cover the common cases—bcrypt hashing, parameterized pg queries, Zod validation, JWT verification, and a complete secured login endpoint flow—paired with concrete MUST DO/MUST NOT DO directives.	5 / 5
Workflow Clarity	A clear 5-step numbered Core Workflow with an explicit Validation Checkpoints checklist (specific payloads and scanner commands), but it stops short of an explicit validate→fix→re-validate feedback loop.	4 / 5
Progressive Disclosure	The body is a clear overview with a Reference Guide table pointing to five real one-level-deep reference files (verified present) with explicit 'Load When' signals; core code examples are kept inline appropriately.	5 / 5
	Total	18 / 20 Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that concretely lists the skill's capabilities, provides rich natural trigger terms, and explicitly covers both what it does and when to invoke it. The boundary guidance steering OAuth/SSO/audits elsewhere further sharpens its niche.

Dimension	Reasoning	Score
Specificity	Lists multiple specific concrete actions—'hashing passwords with bcrypt/argon2, sanitizing SQL queries with parameterized statements, configuring CORS/CSP headers, validating input with Zod, and setting up JWT tokens'—giving comprehensive coverage of the domain's activities.	5 / 5
Completeness	Explicitly answers both 'what' (implement auth, secure input, prevent OWASP, custom security implementations) and 'when' ('Use when implementing...', 'Invoke for...') with concrete trigger phrases.	5 / 5
Trigger Term Quality	Comprehensive natural terms with synonyms and common variations: 'authentication, authorization, input validation, encryption, OWASP Top 10 prevention, secure session management, and security hardening', plus concrete tokens like JWT, bcrypt, CORS, CSP.	5 / 5
Distinctiveness Conflict Risk	Clear niche of custom security implementation with distinct triggers, plus explicit boundary guidance—'For pre-built OAuth/SSO integrations or standalone security audits, consider a more specialized skill'—minimizing conflict risk.	5 / 5
	Total	20 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: jeffallan/claude-skills
Path: skills/secure-code-guardian/SKILL.md
Commit: 882ef55

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.