neo4j-security-skill

Programmatic security management in Neo4j — RBAC/ABAC, user lifecycle (CREATE/ALTER/DROP USER), role lifecycle (CREATE/GRANT ROLE/DROP ROLE), privilege grants and denies (GRANT/DENY/REVOKE on graph, database, DBMS), property-level access control, sub-graph access control, SHOW PRIVILEGES inspection, and auth provider config reference (LDAP, OIDC/SSO). Use when an agent needs to manage users, roles, or privileges programmatically via Cypher on the system database. Does NOT handle Cypher query writing — use neo4j-cypher-skill. Does NOT handle cluster ops or backups — use neo4j-cli-tools-skill. Property-level security and ABAC require Enterprise Edition.

1.19x

Quality

94%

Does it follow best practices?

Impact

100%

1.19x

Average score across 3 eval scenarios

Securityby

Passed

No findings from the security scan

Quality

Content

88%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A high-quality, executable reference body: concrete Cypher throughout, a mandatory confirmation gate and verification checklist for destructive privilege changes, and a real one-level-deep reference file for exhaustive syntax. Slight room to tighten inline config/edge-case material and move it to the reference.

Suggestions

Move the full LDAP/OIDC neo4j.conf blocks (section 9) into references/privilege-reference.md or a dedicated auth-provider reference, keeping only a one-line pointer inline to improve conciseness and progressive disclosure.

Trim the inline PBAC edge-case bullet list in section 5 since the same material is already delegated to references/privilege-reference.md.

Consolidate the duplicated '[2026.xx]' version annotations into a single 'Version notes' subsection so time-sensitive markers don't scatter the runnable examples.

Dimension	Reasoning	Score
Conciseness	The body is dense and mostly earns its tokens with runnable Cypher rather than explaining concepts Claude already knows, though the auth-provider config block and some inline PBAC edge-case lists could be trimmed or pushed to the reference file. It is efficient with only minor over-explanation.	4 / 5
Actionability	Nearly every section gives copy-paste-ready, executable Cypher (CREATE/ALTER/DROP USER, GRANT/DENY/REVOKE, ABAC rules, SHOW PRIVILEGES patterns) plus a privilege decision table and concrete role-pattern examples covering the common cases.	5 / 5
Workflow Clarity	Destructive/batch privilege operations are gated by the mandatory MCP Write Gate (show exact Cypher, annotate impact, get explicit 'yes'), and the closing 'Checklist — New Role Setup' gives a sequenced, validated workflow including SHOW ... PRIVILEGES AS COMMANDS verification steps before assignment.	5 / 5
Progressive Disclosure	SKILL.md is a well-sectioned overview that offloads full privilege syntax and PBAC edge cases to a real, verified one-level-deep reference (references/privilege-reference.md), with inline links clearly signaling where to go; minor gap is that the auth-provider config reference is fully inlined rather than also split out.	4 / 5
	Total	18 / 20 Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that concretely enumerates capabilities, gives an explicit 'Use when' trigger, and clearly delineates scope from sibling Neo4j skills. It avoids fluff and over-claims.

Dimension	Reasoning	Score
Specificity	Lists many concrete actions (RBAC/ABAC, user lifecycle CREATE/ALTER/DROP USER, role lifecycle, GRANT/DENY/REVOKE on graph/database/DBMS, property-level and sub-graph access control, SHOW PRIVILEGES, auth provider config) with comprehensive coverage of the security-management domain.	5 / 5
Completeness	Explicitly answers both 'what' (the enumerated security management capabilities) and 'when' ('Use when an agent needs to manage users, roles, or privileges programmatically via Cypher on the system database'), with concrete trigger phrases and explicit out-of-scope boundaries.	5 / 5
Trigger Term Quality	Includes the natural trigger phrasing a user would say ('manage users, roles, or privileges programmatically via Cypher on the system database') plus the domain keywords RBAC/ABAC, LDAP, OIDC/SSO, and clear pointers to sibling skills.	5 / 5
Distinctiveness Conflict Risk	Carves a clear niche (programmatic security/RBAC/ABAC via Cypher on the system database) and explicitly redirects Cypher query writing to neo4j-cypher-skill and cluster ops/backups to neo4j-cli-tools-skill, minimizing conflict risk.	5 / 5
	Total	20 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: neo4j-contrib/neo4j-skills
Path: neo4j-security-skill/SKILL.md
Commit: a3627d2

Reviewed: 4 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.