security-hardening
Security architecture: authentication, authorization, RLS policies, CSP, input validation, API security. Use when implementing auth flows, writing RLS policies, configuring CSP/headers, validating inputs, or auditing security. Trigger terms: RLS, CSP, Server Actions, Zod, auth flow
77
96%
Does it follow best practices?
Impact
—
No eval scenarios have been run
Passed
No known issues
Quality
Discovery
100%Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.
This is a strong skill description that clearly defines its security architecture domain with specific capabilities, explicit trigger guidance, and natural keywords. It covers both the 'what' and 'when' effectively, and the inclusion of explicit trigger terms (RLS, CSP, Zod, Server Actions) makes it highly distinguishable from other skills. The description is concise yet comprehensive, using proper third-person voice throughout.
| Dimension | Reasoning | Score |
|---|---|---|
Specificity | Lists multiple specific concrete actions and domains: authentication, authorization, RLS policies, CSP, input validation, API security. These are clearly defined security architecture capabilities. | 3 / 3 |
Completeness | Clearly answers both 'what' (security architecture covering auth, RLS, CSP, input validation, API security) and 'when' with an explicit 'Use when...' clause listing specific scenarios like implementing auth flows, writing RLS policies, configuring CSP/headers, validating inputs, or auditing security. | 3 / 3 |
Trigger Term Quality | Includes excellent natural trigger terms that users would actually say: 'RLS', 'CSP', 'Server Actions', 'Zod', 'auth flow', 'input validation', 'authorization'. Good coverage of both acronyms and full terms. | 3 / 3 |
Distinctiveness Conflict Risk | Clearly carved out niche around security architecture with distinct triggers like RLS, CSP, Zod, and auth flows. Unlikely to conflict with general coding or database skills due to the specific security focus and terminology. | 3 / 3 |
Total | 12 / 12 Passed |
Implementation
92%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
This is a strong security skill that covers multiple layers concisely with executable examples and clear validation steps. The architecture table provides an excellent overview, and each section delivers actionable guidance with concrete code. The main weakness is that progressive disclosure could be improved by splitting detailed examples into supporting files, though the cross-references to other skills are well-structured.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The content is lean and well-structured using tables for architecture overview, avoids explaining basic concepts Claude already knows (e.g., what CSP or RLS are), and every section delivers actionable information without padding. | 3 / 3 |
Actionability | Provides fully executable code examples for CSP configuration (next.config.js, middleware), RLS verification SQL, Server Action Zod validation, and cron authorization. Commands like `openssl rand -hex 32` and SQL verification queries are copy-paste ready. | 3 / 3 |
Workflow Clarity | The implementation checklist provides a clear sequence with explicit validation checkpoints (CI checks for RLS, smoke tests for auth, curl validation for headers, security audit gates). The RLS section includes a test-then-verify feedback loop pattern with expected outcomes. | 3 / 3 |
Progressive Disclosure | Cross-references to api-patterns and session-checkpoints skills are well-signaled, and the database skill is referenced for RLS details. However, there are no bundle files to support the references, and the content is moderately long (~130 lines) with some sections (like CSP examples) that could potentially be split out for better organization. | 2 / 3 |
Total | 11 / 12 Passed |
Validation
100%Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.
Validation — 11 / 11 Passed
Validation for skill structure
No warnings or errors.
- Repository
- monkilabs/opencastle
- Commit
7a69a05
- Reviewed
Table of Contents
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.