clay-security-basics
Apply Clay security best practices for API keys, webhook secrets, and data access control. Use when securing Clay integrations, rotating API keys, auditing access, or implementing webhook authentication. Trigger with phrases like "clay security", "clay secrets", "secure clay", "clay API key security", "clay webhook security".
85
83%
Does it follow best practices?
Impact
Pending
No eval scenarios have been run
Passed
No known issues
Quality
Discovery
89%Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.
This is a well-structured skill description that clearly defines its scope around Clay platform security practices. It excels in completeness with explicit 'Use when' and 'Trigger with' clauses, and has strong distinctiveness due to its narrow domain focus. The main weakness is that the specific capabilities could be more concrete—listing actual actions beyond 'apply best practices' would strengthen specificity.
Suggestions
Replace the vague 'Apply Clay security best practices' with more concrete actions, e.g., 'Configure API key rotation schedules, validate webhook signatures, set up role-based data access controls for Clay integrations.'
| Dimension | Reasoning | Score |
|---|---|---|
Specificity | Names the domain (Clay security) and some actions (securing integrations, rotating API keys, auditing access, implementing webhook authentication), but the opening line 'Apply Clay security best practices' is somewhat vague. The actions listed are moderately specific but not deeply concrete (e.g., doesn't specify what 'best practices' entail beyond the listed items). | 2 / 3 |
Completeness | Clearly answers both 'what' (apply security best practices for API keys, webhook secrets, data access control) and 'when' (explicit 'Use when' clause covering securing integrations, rotating keys, auditing access, webhook authentication). Also includes explicit trigger phrases. | 3 / 3 |
Trigger Term Quality | Includes a good range of natural trigger terms: 'clay security', 'clay secrets', 'secure clay', 'clay API key security', 'clay webhook security'. Also includes contextual terms like 'rotating API keys', 'auditing access', 'webhook authentication' that users would naturally say. | 3 / 3 |
Distinctiveness Conflict Risk | Highly distinctive due to the specific 'Clay' platform focus combined with security concerns. The combination of Clay + security + API keys/webhooks creates a clear niche that is unlikely to conflict with generic security skills or other Clay skills. | 3 / 3 |
Total | 11 / 12 Passed |
Implementation
77%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
This is a solid, actionable security skill with executable code examples and clear multi-step workflows including validation checkpoints. Its main weakness is that it's somewhat lengthy for a single SKILL.md with no supporting bundle files—some content (provider table, detailed code examples) could be extracted to referenced files. Minor verbosity in a few spots (prerequisites, some comments) but overall well-structured.
Suggestions
Extract the provider key table and error handling table into a referenced file (e.g., CLAY-SECURITY-REFERENCE.md) to improve progressive disclosure and reduce SKILL.md length.
Remove the prerequisites section—Claude already understands environment variables and secrets management, and 'Clay account with admin access' is implicit from the skill's purpose.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | Generally efficient but includes some unnecessary elements like the provider table (which is more reference than instruction) and the prerequisites section stating obvious things like 'understanding of environment variables.' The PII_FIELDS list and redaction code, while useful, adds bulk. Some explanatory comments could be trimmed. | 2 / 3 |
Actionability | Provides fully executable code examples throughout: bash commands for secrets managers, complete TypeScript middleware for webhook verification, concrete curl commands for testing key rotation, and working PII redaction utilities. All examples are copy-paste ready with realistic values. | 3 / 3 |
Workflow Clarity | Steps are clearly sequenced (Steps 1-6), the key rotation procedure includes explicit validation (test with curl before revoking old key), webhook auth includes rejection handling, and the security checklist serves as a comprehensive validation checkpoint. The error handling table provides clear detection-mitigation feedback loops. | 3 / 3 |
Progressive Disclosure | The content is well-structured with clear sections, but it's fairly long and monolithic for a single file with no bundle support. The provider key table, error handling table, and detailed code examples could be split into referenced files. The reference to 'clay-prod-checklist' at the end is good but there's no corresponding bundle file. | 2 / 3 |
Total | 10 / 12 Passed |
Validation
81%Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.
Validation — 9 / 11 Passed
Validation for skill structure
| Criteria | Description | Result |
|---|---|---|
allowed_tools_field | 'allowed-tools' contains unusual tool name(s) | Warning |
frontmatter_unknown_keys | Unknown frontmatter key(s) found; consider removing or moving to metadata | Warning |
Total | 9 / 11 Passed | |
- Commit
3a2d27d
- Reviewed
Table of Contents
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.