neo4j-security-skill

Programmatic security management in Neo4j — RBAC/ABAC, user lifecycle (CREATE/ALTER/DROP USER), role lifecycle (CREATE/GRANT ROLE/DROP ROLE), privilege grants and denies (GRANT/DENY/REVOKE on graph, database, DBMS), property-level access control, sub-graph access control, SHOW PRIVILEGES inspection, and auth provider config reference (LDAP, OIDC/SSO). Use when an agent needs to manage users, roles, or privileges programmatically via Cypher on the system database. Does NOT handle Cypher query writing — use neo4j-cypher-skill. Does NOT handle cluster ops or backups — use neo4j-cli-tools-skill. Property-level security and ABAC require Enterprise Edition.

1.00x

Quality

90%

Does it follow best practices?

Impact

100%

1.00x

Average score across 1 eval scenario

Securityby

High

Do not use without reviewing

Quality

Content

88%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, highly actionable security skill with executable Cypher, a mandatory confirmation gate, and a verification checklist — strong on actionability and workflow clarity. The main improvement is moving remaining reference-grade detail (built-in roles, full auth-provider config) into the reference file to tighten SKILL.md further.

Suggestions

Move the built-in roles table (section 8) and the full LDAP/OIDC auth-provider config blocks (section 9) into references/privilege-reference.md (or a new references/auth-providers.md), keeping only a one-line pointer in SKILL.md to improve conciseness and progressive disclosure.

Tighten the few prose asides (e.g. the 'Quick note' style explanations) into inline comments so every token earns its place.

Add an explicit error-recovery feedback loop near the MCP Write Gate (e.g. what to do if SHOW ... PRIVILEGES reveals an unexpected DENY) to make the validation loop fully round-tripped.

Dimension	Reasoning	Score
Conciseness	The body is lean and mostly code-plus-comment examples that assume Claude's competence, but a few asides (e.g. inline auth-provider config blocks and the built-in-roles table) carry reference-grade detail that could be trimmed or moved, keeping it just below the fully-lean anchor.	4 / 5
Actionability	Fully executable, copy-paste-ready Cypher throughout — a privilege decision table, parameterised examples, and ready-made role patterns (analyst, writer, dba) cover the common cases concretely.	5 / 5
Workflow Clarity	A destructive/batch security skill with explicit validation checkpoints: the MANDATORY MCP Write Gate (show command, wait for 'yes') and the 'Checklist — New Role Setup' that ends with verification via 'SHOW ROLE ... PRIVILEGES AS COMMANDS' and 'SHOW USER ... PRIVILEGES AS COMMANDS'.	5 / 5
Progressive Disclosure	Good one-level-deep structure with the bulk privilege syntax correctly offloaded to references/privilege-reference.md (a real, clearly-signaled file referenced twice), though some reference-type content (built-in roles table, full auth-provider config) is inlined in SKILL.md rather than split out.	4 / 5
	Total	18 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, concrete description that crisply scopes the skill's security-management domain with explicit use-when triggers and clear hand-off boundaries to sibling Neo4j skills. Minor room to add a few more natural-language synonyms alongside the technical terminology.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions with command-level specificity — 'CREATE/ALTER/DROP USER', 'GRANT/DENY/REVOKE on graph, database, DBMS', 'property-level access control', 'SHOW PRIVILEGES inspection' — giving comprehensive coverage of the security-management domain.	5 / 5
Completeness	Explicitly answers both 'what' ('Programmatic security management in Neo4j ...') and 'when' ('Use when an agent needs to manage users, roles, or privileges programmatically via Cypher on the system database') with concrete trigger phrases.	5 / 5
Trigger Term Quality	Includes natural terms a user would say ('manage users, roles, or privileges', 'RBAC/ABAC', 'LDAP', 'OIDC/SSO') but leans heavily on technical jargon and misses a few common synonyms/phrasings, placing it just below the comprehensive anchor.	4 / 5
Distinctiveness Conflict Risk	A clear Neo4j-security niche with explicit boundary guidance ('Does NOT handle Cypher query writing — use neo4j-cypher-skill', 'Does NOT handle cluster ops or backups — use neo4j-cli-tools-skill'), minimizing conflict risk with sibling skills.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: neo4j-contrib/neo4j-skills
Path: neo4j-security-skill/SKILL.md
Commit: a9a5e78

Reviewed: 6 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.