clay-security-basics

Apply Clay security best practices for API keys, webhook secrets, and data access control. Use when securing Clay integrations, rotating API keys, auditing access, or implementing webhook authentication. Trigger with phrases like "clay security", "clay secrets", "secure clay", "clay API key security", "clay webhook security".

Quality

96%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

92%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A high-quality, actionable security skill with lean code examples and a well-sequenced workflow including validation before destructive rotation. The only gap is progressive disclosure: it is monolithic with no bundle files, and its one cross-reference points to a missing target.

Suggestions

Split the provider-key table and the detailed TypeScript/HMAC code into a referenced bundle file (e.g. references/webhook-auth.md) so SKILL.md stays a lean overview with one-level-deep links.

Resolve the dangling "see clay-prod-checklist" reference: either add the referenced skill/file or remove the pointer to avoid a dead navigation link.

Consider moving the Error Handling table and Security Checklist into a referenced reference file to keep the core workflow steps prominent in the main body.

Dimension	Reasoning	Score
Conciseness	The body is code-first and lean: it presents executable snippets and tables without explaining concepts Claude already knows (HMAC, timing-safe comparison, secrets managers), so every section earns its tokens.	3 / 3
Actionability	It provides fully executable bash (gh secret set, gcloud, aws, curl) and TypeScript (HMAC verification, PII redaction) that is specific and copy-paste ready, matching the top anchor.	3 / 3
Workflow Clarity	Steps 1–6 are clearly sequenced, and the destructive key-rotation procedure includes an explicit validation checkpoint ("Test connectivity" then "Once confirmed working, revoke old key"), plus a closing checklist.	3 / 3
Progressive Disclosure	Sections are well organized, but the skill is a single monolithic document over 50 lines with no bundle files, and the only forward reference ("see clay-prod-checklist") points to a non-existent target rather than a one-level-deep bundle file.	2 / 3
	Total	11 / 12 Passed

Description

100%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description: concrete capabilities, explicit Use-when triggers, natural trigger phrases, and a distinct Clay-specific niche with low conflict risk. All four dimensions score at the top of the scale.

Dimension	Reasoning	Score
Specificity	The description enumerates multiple concrete actions—"securing Clay integrations, rotating API keys, auditing access, or implementing webhook authentication"—matching the anchor for listing several specific concrete actions rather than a single vague verb.	3 / 3
Completeness	It answers both "what" ("Apply Clay security best practices for API keys, webhook secrets, and data access control") and "when" ("Use when securing Clay integrations, rotating API keys...") with explicit triggers, matching the top anchor.	3 / 3
Trigger Term Quality	Explicit trigger phrases like "clay security", "clay secrets", "secure clay", "clay API key security", and "clay webhook security" are natural terms a user would say, giving good coverage.	3 / 3
Distinctiveness Conflict Risk	The Clay-specific niche with dedicated trigger phrases makes it clearly distinguishable and unlikely to fire for unrelated skills.	3 / 3
	Total	12 / 12 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
allowed_tools_field	'allowed-tools' contains unusual tool name(s)	Warning
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	14 / 16 Passed

Repository: jeremylongshore/claude-code-plugins-plus-skills
Path: plugins/saas-packs/clay-pack/skills/clay-security-basics/SKILL.md
Commit: 0540a62

Reviewed: about 11 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.