propose-security-hardening

Develop evidence-backed structural and architectural security hardening proposals from vulnerability disclosures, supplied findings, incident or assessment documents, source code, or a completed Codex Security scan. Use when a user asks for systemic improvements, alternatives beyond per-finding patches, before-and-after security architecture views, engineering tradeoff analysis, or an implementation-ready plan for a selected hardening option. Also use automatically after a Codex Security scan with reportable findings when the top-level scan workflow requests final-report hardening guidance.

Quality

92%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Quality

Content

85%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a well-structured, highly actionable instruction skill with a clear 10-step workflow, explicit validation gates, and appropriate progressive disclosure via a real reference file. Its main weakness is conciseness: several rules and tone guidance are restated across sections and could be consolidated without losing clarity.

Suggestions

Consolidate the first-person voice guidance, which currently appears in the Objective (lines 23-29) and again in the Quality Bar (lines 228-229), into a single statement to remove redundancy.

Merge the recurring 'do not manufacture superficial options / do not force a fixed number of options' rules that repeat across steps 5, 9, and the Quality Bar into one canonical location.

Trim the rhetorical tone coaching ('professionally warm, calm, not chatty, not theatrical') to the essential directive, since the actionable constraint (truthful first-person, vary the discussion) is already covered.

Dimension	Reasoning	Score
Conciseness	Most content is genuinely novel procedural/contract guidance rather than concepts Claude already knows, but several rules are restated across the Objective, Workflow, and Quality Bar (first-person voice rules, 'do not manufacture options', evidence-ID definability) and the tone coaching ('professionally warm, calm, not chatty') is rhetorical padding that could be tightened.	2 / 3
Actionability	As an instruction-only skill it gives concrete, copy-applicable guidance: explicit artifact paths (context.md, proposals/<id>.md, diagrams/<id>-before.mmd, hardening.json), fixed taxonomies (measured/source-derived/analogous/hypothetical; addresses/mitigates/unaffected/unknown; Observed/Inferred/Proposed), named tools, and exact table columns.	3 / 3
Workflow Clarity	A clearly sequenced 10-step workflow with an explicit validation checkpoint in step 9 (a concrete 'do not hand off until these checks pass' checklist verifying hardening.json parses, cross-references agree, and all required artifacts are present) and a feedback loop with drift re-validation in step 10.	3 / 3
Progressive Disclosure	The body is the overview/process while the detailed format contract is split into references/proposal-format.md (verified to exist) with one-level-deep, clearly signaled navigation ('Read ... completely before drafting. Treat ... as part of the artifact contract'), with no nested reference chains.	3 / 3
	Total	11 / 12 Passed

Description

100%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, complete, and well-triggered, clearly stating both what the skill does and when to use it with natural language a user would say. It carves a distinct niche (architectural hardening vs. per-finding patches) with low conflict risk and uses correct third-person voice.

Dimension	Reasoning	Score
Specificity	It lists multiple concrete actions and deliverables — evidence-backed hardening proposals, before-and-after architecture views, engineering tradeoff analysis, and implementation-ready plans — alongside concrete input sources, matching the score-3 anchor.	3 / 3
Completeness	It explicitly answers both what ('Develop evidence-backed structural and architectural security hardening proposals...') and when via an explicit 'Use when...' trigger plus an automatic-trigger clause, satisfying the score-3 anchor.	3 / 3
Trigger Term Quality	The 'Use when a user asks for systemic improvements, alternatives beyond per-finding patches, before-and-after security architecture views, engineering tradeoff analysis, or an implementation-ready plan' clause covers natural request phrasings a user would actually say.	3 / 3
Distinctiveness Conflict Risk	The niche — architectural/structural hardening distinct from per-finding patches and scan reporting, tied to Codex Security scans — is clearly scoped with distinct triggers unlikely to overlap generic remediation skills.	3 / 3
	Total	12 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: openai/plugins
Path: plugins/codex-security/skills/propose-security-hardening/SKILL.md
Commit: 11c74d6

Reviewed: 17 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.