Name: apply-universal-policy
Rating: 72.8 (1 reviews)
Author: mulesoft

apply-universal-policy

Protect a portfolio slice by applying one Universal (canonical) policy across API instances on any gateway (Kong, Apigee, Azure, AWS, MuleSoft). Use when the user says all / many / my APIs / a portfolio slice — JWT validation, rate limiting, spike arrest, IP filtering, or apply one config across providers. DO NOT TRIGGER for "what protection do I have" / listing or editing already- applied native policies — use skill apply-native-policy-to-instance. DO NOT TRIGGER for a single already-chosen instance that needs a provider-native plugin — same skill. Do not use to remove, detach, enable, or disable a policy (those tools do not exist).

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

85%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, highly actionable skill body with a clear multi-step workflow, explicit validation gates, and clean progressive disclosure into two real reference files. The main weakness is repetition of the routing/sibling-skill disambiguation across several sections, which inflates token cost.

Suggestions

Consolidate the routing disambiguation ('what's applied' / 'change native' → apply-native-policy-to-instance) into a single section; it is currently restated in When-to-Use, Pick-the-path-first, Best Practices, and Troubleshooting.

Similarly, the 'one apply call for Universal / don't loop native apply' guidance appears in both the Workflow rules and Best Practices — keep it in one place and cross-reference to save tokens.

Dimension	Reasoning	Score
Conciseness	The body is dense and operational and assumes Claude's domain knowledge, but the routing disambiguation ('what's applied' / 'change native' → apply-native-policy-to-instance) is restated across When-to-Use, Pick-the-path-first, Best Practices, and Troubleshooting, so it is mostly efficient but could be tightened by consolidating that guidance.	3 / 5
Actionability	Gives exact tool names and parameters (find_assets with query/asset_type/user_query/include_applied_policies/policy_name_filter/max_results; apply_universal_policy with policy_name/instance_ids/configuration) plus concrete status branching, providing fully executable orchestration guidance appropriate to an instruction-only MCP skill.	5 / 5
Workflow Clarity	Steps 1–4 are clearly sequenced with explicit [GATE] checkpoints, a poll-until-COMPLETED/FAILED feedback loop, an unknown-coverage re-check rule, and an assetCap fan-out — the validation and feedback loops this batch operation requires are all present.	5 / 5
Progressive Disclosure	SKILL.md is a clear overview pointing to two real one-level-deep reference files (payloads.md, presentation-format.md), signaled in a dedicated Reference files section and inline at the exact points they are needed, with the bulk detail appropriately split out.	5 / 5
	Total	18 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, concrete description that clearly states capability, gives natural trigger phrases, and proactively disambiguates from sibling skills. Trigger-term coverage is the only mild gap, with a few natural phrasings a user might say not enumerated.

Suggestions

Consider adding a couple more natural phrasings users might say (e.g. 'protect all my APIs', 'apply this policy everywhere') to lift trigger-term coverage toward comprehensive.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — applying one Universal/canonical policy across API instances and naming JWT validation, rate limiting, spike arrest, and IP filtering — with comprehensive policy-type and multi-provider coverage, matching the 'multiple specific concrete actions' anchor.	5 / 5
Completeness	Explicitly answers both what ('Protect a portfolio slice by applying one Universal policy across API instances on any gateway') and when ('Use when the user says all / many / my APIs / a portfolio slice') with concrete trigger phrases, matching the top anchor.	5 / 5
Trigger Term Quality	Captures natural user phrasing ('all / many / my APIs', 'a portfolio slice') plus policy names users would say; good keyword coverage but not quite comprehensive across all synonyms a user might voice, so it sits above the midpoint rather than at the top anchor.	4 / 5
Distinctiveness Conflict Risk	Carves a clear Universal/canonical-policy niche and adds explicit 'DO NOT TRIGGER' boundaries that disambiguate from sibling skills (apply-native-policy-to-instance, apply-policy-to-api-instance), giving minimal conflict risk.	5 / 5
	Total	19 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: mulesoft/mulesoft-dx
Path: skills/apply-universal-policy/SKILL.md
Commit: 4cf0cf6

Reviewed: 5 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.