security-hardening

Security architecture: authentication, authorization, RLS policies, CSP, input validation, API security. Use when implementing auth flows, writing RLS policies, configuring CSP/headers, validating inputs, or auditing security. Trigger terms: RLS, CSP, Server Actions, Zod, auth flow

Quality

96%

Does it follow best practices?

Impact

—

No eval scenarios have been run

Securityby

Passed

No known issues

Quality

Content

92%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

This is a strong security skill that covers multiple layers concisely with executable examples and clear validation steps. The architecture table provides an excellent overview, and each section delivers actionable guidance with concrete code. The main weakness is that progressive disclosure could be improved by splitting detailed examples into supporting files, though the cross-references to other skills are well-structured.

Dimension	Reasoning	Score
Conciseness	The content is lean and well-structured using tables for architecture overview, avoids explaining basic concepts Claude already knows (e.g., what CSP or RLS are), and every section delivers actionable information without padding.	3 / 3
Actionability	Provides fully executable code examples for CSP configuration (next.config.js, middleware), RLS verification SQL, Server Action Zod validation, and cron authorization. Commands like `openssl rand -hex 32` and SQL verification queries are copy-paste ready.	3 / 3
Workflow Clarity	The implementation checklist provides a clear sequence with explicit validation checkpoints (CI checks for RLS, smoke tests for auth, curl validation for headers, security audit gates). The RLS section includes a test-then-verify feedback loop pattern with expected outcomes.	3 / 3
Progressive Disclosure	Cross-references to api-patterns and session-checkpoints skills are well-signaled, and the database skill is referenced for RLS details. However, there are no bundle files to support the references, and the content is moderately long (~130 lines) with some sections (like CSP examples) that could potentially be split out for better organization.	2 / 3
	Total	11 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

This is a strong skill description that clearly defines its security architecture domain with specific capabilities, explicit trigger guidance, and natural keywords. It covers both the 'what' and 'when' effectively, and the inclusion of explicit trigger terms (RLS, CSP, Zod, Server Actions) makes it highly distinguishable from other skills. The description is concise yet comprehensive, using proper third-person voice throughout.

Dimension	Reasoning	Score
Specificity	Lists multiple specific concrete actions and domains: authentication, authorization, RLS policies, CSP, input validation, API security. These are clearly defined security architecture capabilities.	3 / 3
Completeness	Clearly answers both 'what' (security architecture covering auth, RLS, CSP, input validation, API security) and 'when' with an explicit 'Use when...' clause listing specific scenarios like implementing auth flows, writing RLS policies, configuring CSP/headers, validating inputs, or auditing security.	3 / 3
Trigger Term Quality	Includes excellent natural trigger terms that users would actually say: 'RLS', 'CSP', 'Server Actions', 'Zod', 'auth flow', 'input validation', 'authorization'. Good coverage of both acronyms and full terms.	3 / 3
Distinctiveness Conflict Risk	Clearly carved out niche around security architecture with distinct triggers like RLS, CSP, Zod, and auth flows. Unlikely to conflict with general coding or database skills due to the specific security focus and terminology.	3 / 3
	Total	12 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 11 / 11 Passed

Validation for skill structure

No warnings or errors.

Repository: monkilabs/opencastle
Commit: 7a69a05

Reviewed: about 1 month ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.