rag-cag-security

Security patterns for RAG and CAG systems with multi-tenant isolation. Use when building retrieval-augmented or cache-augmented generation systems that require tenant isolation, access control, and secure data handling.

Quality

77%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./plugins/rag-cag/skills/rag-cag-security/SKILL.md

Quality

Content

61%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A reasonably concise, well-organized reference of RAG/CAG security patterns with several concrete code examples. Its main gaps are an incomplete prompt-injection example that calls undefined functions and the absence of a sequenced, validated workflow for security operations.

Suggestions

Implement remove_instruction_patterns and escape_prompt_chars (or link to a script/reference that defines them) so the sanitize_retrieved_context example is fully executable rather than pseudocode.

Add a short sequenced workflow with validation checkpoints (e.g., verify tenant isolation holds after indexing, validate access checks pass before serving results) instead of relying solely on the closing checklist.

Move the data-classification table and detailed permission logic into a references/ file and link to it from SKILL.md to deepen progressive disclosure and keep the overview leaner.

Dimension	Reasoning	Score
Conciseness	The body is lean with tight code blocks and minimal over-explanation; only minor padding (the redundant intro line and a few obvious comments) could be trimmed.	4 / 5
Actionability	The metadata-filtering and can_access examples are executable, but sanitize_retrieved_context relies on undefined helpers (remove_instruction_patterns, escape_prompt_chars), making a core example effectively pseudocode with key details missing.	3 / 5
Workflow Clarity	Content is organized topically with a closing checklist, but there is no sequenced workflow and no validation/verification checkpoints for security-sensitive operations, capping clarity at 3.	3 / 5
Progressive Disclosure	No bundle files exist; all content lives inline in well-organized sections that are easy to navigate, though the body slightly exceeds the simple-skill threshold where a couple of reference files could offload detail.	4 / 5
	Total	14 / 20 Passed

Description

82%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description that clearly states both purpose and trigger conditions with good keyword coverage and a distinct niche. The only weakness is that capabilities are framed as topic areas rather than concrete actions.

Dimension	Reasoning	Score
Specificity	Names the domain ('Security patterns for RAG and CAG systems') and lists concrete security areas (tenant isolation, access control, secure data handling), but these are topics rather than discrete executable actions, leaving coverage non-comprehensive.	3 / 5
Completeness	Explicitly answers both what ('Security patterns for RAG and CAG systems with multi-tenant isolation') and when ('Use when building retrieval-augmented or cache-augmented generation systems that require...').	5 / 5
Trigger Term Quality	Includes natural terms a developer would say ('RAG', 'CAG', 'retrieval-augmented', 'cache-augmented generation', 'tenant isolation', 'access control'), with only minor synonyms missing.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (RAG/CAG security with multi-tenant isolation) with distinct triggers, making conflict with other skills unlikely.	5 / 5
	Total	17 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: jpoutrin/product-forge
Path: plugins/rag-cag/skills/rag-cag-security/SKILL.md
Commit: 0ebe7ae

Reviewed: 7 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.