security-headers-configuration
Configures HTTP security headers to protect against XSS, clickjacking, and MIME sniffing attacks. Use when hardening web applications, passing security audits, or implementing Content Security Policy.
73
89%
Does it follow best practices?
Impact
—
No eval scenarios have been run
Passed
No known issues
Quality
Discovery
100%Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.
This is an excellent skill description that clearly communicates specific capabilities, includes natural trigger terms users would use, and explicitly states both what the skill does and when to use it. It uses proper third-person voice and is concise without being vague. The description carves out a distinct niche that would be easily distinguishable from other skills.
| Dimension | Reasoning | Score |
|---|---|---|
Specificity | Lists multiple specific concrete actions: configuring HTTP security headers, protecting against XSS, clickjacking, and MIME sniffing attacks, and implementing Content Security Policy. These are concrete, well-defined capabilities. | 3 / 3 |
Completeness | Clearly answers both 'what' (configures HTTP security headers to protect against specific attacks) and 'when' (explicitly states 'Use when hardening web applications, passing security audits, or implementing Content Security Policy'). | 3 / 3 |
Trigger Term Quality | Includes strong natural keywords users would say: 'security headers', 'XSS', 'clickjacking', 'MIME sniffing', 'security audits', 'Content Security Policy', 'hardening web applications'. These cover the main terms a user would naturally use when needing this skill. | 3 / 3 |
Distinctiveness Conflict Risk | Highly distinctive with a clear niche focused on HTTP security headers specifically. The trigger terms (XSS, clickjacking, MIME sniffing, Content Security Policy, security headers) are specific enough to avoid conflicts with general web development or broader security skills. | 3 / 3 |
Total | 12 / 12 Passed |
Implementation
79%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
This is a well-structured, concise skill that provides actionable security header configurations for multiple platforms. Its main weaknesses are the lack of an explicit implementation-and-verification workflow with feedback loops (important for security configurations) and an unverifiable reference to a bundle file that doesn't exist.
Suggestions
Add an explicit workflow sequence: 1. Implement headers → 2. Verify with securityheaders.com → 3. If score < A, review missing headers → 4. Re-verify until passing
Either provide the referenced python-apache.md bundle file or remove the reference to avoid broken navigation
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The content is lean and well-structured. The table format for essential headers is efficient, code examples are practical without unnecessary explanation, and there's no over-explaining of concepts Claude already knows. | 3 / 3 |
Actionability | Provides fully executable code for both Express (with helmet) and Nginx configurations that are copy-paste ready. The CSP directives example is concrete with realistic values, and verification tools are linked for testing. | 3 / 3 |
Workflow Clarity | While the checklist provides a good summary of what to verify, there's no explicit workflow sequence for implementing headers (e.g., implement → verify with tools → fix issues → re-verify). The verification tools are listed but not integrated into a feedback loop, which matters for security-critical configuration. | 2 / 3 |
Progressive Disclosure | References python-apache.md for additional implementations, which is good structure, but the bundle file doesn't exist (no bundle files provided), making the reference unverifiable. The main content is well-organized with clear sections but the reference path cannot be validated. | 2 / 3 |
Total | 10 / 12 Passed |
Validation
100%Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.
Validation — 11 / 11 Passed
Validation for skill structure
No warnings or errors.
- Repository
- secondsky/claude-skills
- Commit
5e92b71
- Reviewed
Table of Contents
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.