Content
82%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A strong, highly actionable reference body: executable Cypher everywhere, a verification-bearing checklist, and sensible overflow to one real reference file. The main headroom is tightening overlap between the decision table and pattern sections, and offloading the inline auth-provider config to a reference.
Suggestions
Add a short verify→fix→retry note to the checklist (e.g. 'If SHOW PRIVILEGES reveals an unexpected grant/deny, REVOKE it and re-verify') to close the feedback loop for incorrect privilege changes.
Move the §9 auth provider config block (LDAP/OIDC neo4j.conf settings) into a references/auth-providers.md file, keeping only a pointer and the restart caveat in SKILL.md.
Trim duplication between the §3 decision table and §4/§5 examples — e.g. drop the property-read rows from §3 since §5 covers property-level control in full.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | Command-first sections with terse, version-tagged comments keep the body dense, and version markers ([2026.06+], [2026.09], Cypher 25) are load-bearing rather than padding. Minor trimmable material remains: slight overlap between the §3 decision table and §4/§5 examples, and a few restated basics ('CHANGE REQUIRED (default): forces password change on first login'). | 4 / 5 |
Actionability | Nearly everything is copy-paste-ready Cypher: parameterized passwords ('CREATE USER $username SET PASSWORD $password'), idempotent guards ('DROP USER alice IF EXISTS', 'CREATE ROLE analyst IF NOT EXISTS'), a goal→command decision table, and complete role recipes covering common cases. | 5 / 5 |
Workflow Clarity | The 'Checklist — New Role Setup' sequences the full process with explicit verification steps ('Run SHOW ROLE ... PRIVILEGES AS COMMANDS to verify', 'Test with SHOW USER ... PRIVILEGES AS COMMANDS') and the mandatory write gate adds a pre-execution checkpoint. A 3-cap does not apply since validation is present, but no explicit verify→fix→retry loop is spelled out for failed or incorrect grants. | 4 / 5 |
Progressive Disclosure | A single real, one-level-deep reference (references/privilege-reference.md, no nested links) is well signaled at three natural exit points (§5 PBAC edge cases, §6 Infinigraph note, closing full-syntax pointer). The 439-line body still inlines operational bulk — notably §9's auth provider config block — that could be split into a second reference file. | 4 / 5 |
Total | 17 / 20 Passed |