security-hardening

Application security covering input validation, auth, headers, secrets management, and dependency auditing

Quality

57%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/security-hardening/SKILL.md

Quality

Content

65%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable with concrete, executable code and configs across all major web-security areas, and is reasonably lean. Its main weaknesses are the lack of an explicit sequenced workflow and the monolithic single-file structure with no progressive disclosure.

Suggestions

Add a short sequenced 'Hardening workflow' (audit -> validate -> configure headers/secrets -> verify) with an explicit validation/retest checkpoint so multi-step work is unambiguous.

Split the larger reference-style sections (CSP, security headers, JWT, secrets management, dependency auditing) into one-level-deep reference files (e.g. references/headers.md, references/secrets.md) linked from the overview to improve progressive disclosure.

Trim restatements of widely-known concepts (e.g. 'Never commit secrets to version control') to terse rules to tighten token efficiency further.

Dimension	Reasoning	Score
Conciseness	The body is mostly dense and practical (code blocks, terse rules) with little explanatory fluff, but a fair amount restates general security knowledge Claude already knows (parameterized queries, HSTS, never commit secrets) and some sections could be tightened, matching the level-2 anchor.	2 / 3
Actionability	It provides copy-paste-ready, executable guidance throughout: a zod schema, parameterized query examples, CSRF middleware, a concrete CSP, exact security headers, rate-limit config, a jwt.verify call, and real audit commands (gitleaks, npm audit, pip-audit), matching the level-3 anchor.	3 / 3
Workflow Clarity	Content is organized by topic rather than as a sequenced multi-step workflow, and although the final 'Checklist Before Deploy' provides a validation checkpoint, there is no explicit end-to-end sequence with feedback loops, so it does not reach level 3.	2 / 3
Progressive Disclosure	The single ~150-line SKILL.md is well-organized into clearly headed sections, but it is a monolithic file with no bundle references and several self-contained sections (CSP, headers, JWT, secrets) could live in separate reference files; the under-50-line exemption does not apply.	2 / 3
	Total	9 / 12 Passed

Description

50%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description names a clear domain and lists relevant sub-areas but stops short of providing concrete actions or explicit usage triggers. It is functional but generic and would benefit from verb-based capabilities and a 'Use when' clause.

Suggestions

Add an explicit 'Use when...' clause naming concrete triggers, e.g. 'Use when hardening a web app, reviewing security posture, or when the user mentions XSS, SQL injection, CSRF, secrets, or dependency vulnerabilities.'

Rewrite the capability list as concrete actions rather than topic nouns, e.g. 'Validates input, configures security headers, parameterizes SQL, manages secrets, and audits dependencies.'

Include common natural trigger terms users say (XSS, CSRF, SQL injection, security review, pentest, vulnerability scan) to improve distinctiveness and discovery.

Dimension	Reasoning	Score
Specificity	The description names the domain ('Application security') and several specific sub-areas ('input validation, auth, headers, secrets management, and dependency auditing'), but these are noun-phrase topic categories rather than concrete verb-based actions like the level-3 anchor, so it sits at level 2.	2 / 3
Completeness	It clearly states what the skill covers but provides no 'Use when...' clause or equivalent trigger guidance, so per the rubric guideline completeness is capped at 2.	2 / 3
Trigger Term Quality	It includes several natural terms a user might say ('application security', 'auth', 'secrets management', 'dependency auditing'), but omits common variations users actually say such as 'XSS', 'SQL injection', 'CSRF', 'security review', or 'vulnerability scanning', matching the level-2 anchor.	2 / 3
Distinctiveness Conflict Risk	The 'Application security' niche is fairly specific, but without explicit triggers and given the breadth of the topic, it could overlap with general coding or code-review skills, matching the level-2 'could still overlap' anchor.	2 / 3
	Total	8 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: rohitg00/awesome-claude-code-toolkit
Path: skills/security-hardening/SKILL.md
Commit: ebdf1d5

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.