security-hardening

Security architecture: authentication, authorization, RLS policies, CSP, input validation, API security. Use when implementing auth flows, writing RLS policies, configuring CSP/headers, validating inputs, or auditing security. Trigger terms: RLS, CSP, Server Actions, Zod, auth flow

Quality

87%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

86%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A tight, actionable security reference with concrete commands and validation gates for destructive/risky operations. The main gap is a few directive-style auth instructions that lack complete copy-paste code examples.

Dimension	Reasoning	Score
Conciseness	The body is lean and dense: every line is actionable guidance (SQL snippets, env var patterns, curl verification) with no padding or explanation of concepts Claude already knows.	5 / 5
Actionability	Provides concrete executable commands (ALTER TABLE ... ENABLE ROW LEVEL SECURITY, auth.uid(), curl -I, Bearer ${process.env.CRON_SECRET}, openssl rand -hex 32) but the auth section relies on directives ('go through a Server Action') and 'React Hook Form client-side' rather than full copy-paste code blocks.	4 / 5
Workflow Clarity	Validation checkpoints are present for risky operations (RLS CI gate with positive/negative row-visibility test and 'Block merges on failure'; CSP 'Validate shipped headers with curl -I'), but the body is a topical reference rather than a single clearly-sequenced multi-step workflow.	4 / 5
Progressive Disclosure	Under 50 lines with well-organized sections (Authentication, CSP, RLS, API Security) and clearly signaled one-level-deep cross-references to sibling skills (database skill for RLS, api-patterns, session-checkpoints); no bundle files exist to require further splitting.	5 / 5
	Total	18 / 20 Passed

Description

88%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description that explicitly covers both capabilities and use-when triggers with concrete security-specific terms. Minor improvements possible by adding spelled-out synonyms for the abbreviated trigger terms.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete capability domains (authentication, authorization, RLS policies, CSP, input validation, API security) paired with concrete actions (implementing auth flows, writing RLS policies, configuring CSP/headers, validating inputs, auditing security), giving comprehensive coverage.	5 / 5
Completeness	Clearly states what it does ('Security architecture: authentication, authorization, RLS policies, CSP, input validation, API security') and when to use it ('Use when implementing auth flows, writing RLS policies, configuring CSP/headers, validating inputs, or auditing security') with concrete trigger phrases.	5 / 5
Trigger Term Quality	Explicit trigger terms (RLS, CSP, Server Actions, Zod, auth flow) are natural developer vocabulary, but spelled-out synonyms like 'Row Level Security' or 'Content Security Policy' and broader terms like 'permissions'/'headers' are partly missing.	4 / 5
Distinctiveness Conflict Risk	The security niche is distinct and triggers (RLS, CSP) are security-specific, but 'Server Actions' and 'Zod' overlap with api-patterns/validation skills and the body cross-references sibling skills, giving minor overlap risk.	4 / 5
	Total	18 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
relative_links	Relative link issues: 2 suspicious	Warning

	Total	15 / 16 Passed

Repository: monkilabs/opencastle
Path: src/orchestrator/skills/security-hardening/SKILL.md
Commit: fa0c341

Reviewed: 5 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.