clay-security-basics
Apply Clay security best practices for API keys, webhook secrets, and data access control. Use when securing Clay integrations, rotating API keys, auditing access, or implementing webhook authentication. Trigger with phrases like "clay security", "clay secrets", "secure clay", "clay API key security", "clay webhook security".
85
83%
Does it follow best practices?
Impact
Pending
No eval scenarios have been run
Passed
No known issues
Quality
Discovery
89%Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.
This is a well-structured skill description that clearly defines its scope around Clay platform security practices. It excels in completeness with explicit 'Use when' and 'Trigger with' clauses, and the trigger terms are natural and well-chosen. The main area for improvement is slightly more specific concrete actions beyond the general categories listed.
| Dimension | Reasoning | Score |
|---|---|---|
Specificity | Names the domain (Clay security) and some actions (API keys, webhook secrets, data access control, rotating keys, auditing access, webhook authentication), but the actions are somewhat general categories rather than deeply specific concrete operations like 'encrypt secrets at rest' or 'configure IP allowlists'. | 2 / 3 |
Completeness | Clearly answers both 'what' (apply Clay security best practices for API keys, webhook secrets, and data access control) and 'when' (explicit 'Use when' clause covering securing integrations, rotating keys, auditing access, implementing webhook auth, plus explicit trigger phrases). | 3 / 3 |
Trigger Term Quality | Includes explicit trigger phrases like 'clay security', 'clay secrets', 'secure clay', 'clay API key security', 'clay webhook security' which are natural terms a user would say. Also includes relevant keywords throughout like 'rotating API keys', 'auditing access', and 'webhook authentication'. | 3 / 3 |
Distinctiveness Conflict Risk | Highly specific to Clay platform security concerns — the combination of 'Clay' + security-specific actions (API key rotation, webhook authentication, access auditing) creates a clear niche that is unlikely to conflict with general security skills or other Clay skills focused on different aspects. | 3 / 3 |
Total | 11 / 12 Passed |
Implementation
77%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
This is a solid, actionable security skill with executable code examples across multiple languages and platforms. Its main weakness is length — several code blocks (webhook middleware, PII redaction) could be extracted to referenced files to keep the SKILL.md leaner. The workflow is well-sequenced with appropriate validation checkpoints, particularly in the key rotation procedure.
Suggestions
Extract the webhook middleware and data protection code into separate referenced files (e.g., `clay-webhook-auth.md`, `clay-data-protection.md`) to reduce SKILL.md length
Remove the prerequisites section and overview paragraph — Claude doesn't need to be told what PII is or that it needs admin access
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The content is mostly efficient with concrete examples, but includes some unnecessary elements like the provider table (which is more of a Clay UI guide than security instruction), the prerequisites section stating obvious things, and the 'Overview' paragraph explaining what PII is. The checklist and error handling table add value but could be tighter. | 2 / 3 |
Actionability | Fully executable code examples throughout: bash commands for secrets managers, complete TypeScript middleware for webhook verification, curl commands for testing key rotation, and working PII redaction functions. Every step has copy-paste ready code or specific commands. | 3 / 3 |
Workflow Clarity | Steps are clearly sequenced from foundational (key storage) through webhook auth, provider isolation, key rotation, and data protection. The key rotation procedure includes explicit validation (curl test before revoking old key), and the security checklist serves as a comprehensive verification checkpoint. The error handling table provides clear detection-mitigation feedback loops. | 3 / 3 |
Progressive Disclosure | The content is well-structured with clear sections and a logical flow, but it's fairly long and monolithic for a SKILL.md. The webhook middleware code and data protection utilities could be referenced as separate files rather than inlined. The 'Next Steps' reference to clay-prod-checklist is good but the main body could benefit from more splitting. | 2 / 3 |
Total | 10 / 12 Passed |
Validation
81%Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.
Validation — 9 / 11 Passed
Validation for skill structure
| Criteria | Description | Result |
|---|---|---|
allowed_tools_field | 'allowed-tools' contains unusual tool name(s) | Warning |
frontmatter_unknown_keys | Unknown frontmatter key(s) found; consider removing or moving to metadata | Warning |
Total | 9 / 11 Passed | |
- Commit
70e9fa4
- Reviewed
Table of Contents
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.