CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

security-headers-configuration

Configures HTTP security headers to protect against XSS, clickjacking, and MIME sniffing attacks. Use when hardening web applications, passing security audits, or implementing Content Security Policy.

Quality

90%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

93%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

An exemplary SKILL.md body: lean, executable, and well-organized, with appropriate offloading of secondary stacks to a clearly signaled reference file. The only gap is that verification (checklist, scanning tools) is presented as a list rather than an ordered workflow with a fix-and-rescan loop.

DimensionReasoningScore

Conciseness

The body is a lean table, two copy-paste config blocks, a tool list, and a checklist; it explains nothing Claude already knows and every section earns its place, matching anchor 5.

5 / 5

Actionability

Fully executable code for the two most common servers (helmet() Express config and Nginx add_header directives) plus named verification tools — copy-paste ready and covering the common cases, matching anchor 5.

5 / 5

Workflow Clarity

A security-headers checklist and verification tools are present, but there is no explicit implement → verify → fix sequence tying them together; this sits between anchor 4 (most checkpoints, minor gaps) and anchor 5 (explicit feedback loop).

4 / 5

Progressive Disclosure

Common cases (Express, Nginx) stay inline while Python/Apache move to a well-signaled, one-level-deep references/python-apache.md with a bulleted preview of its contents — exactly the anchor-5 pattern.

5 / 5

Total

19

/

20

Passed

Description

82%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description with explicit what/when structure and low conflict risk. Its main weakness is that it states a single broad action rather than enumerating the specific header configurations it covers, and it misses a few natural trigger synonyms.

Suggestions

Enumerate concrete actions instead of one broad verb, e.g. 'Configures HSTS, CSP, X-Frame-Options, and X-Content-Type-Options headers...' to raise specificity.

Add natural trigger synonyms users would actually say — 'security headers', 'CSP', 'HTTPS', 'helmet', 'security audit' — to widen trigger coverage.

Mention the supported stacks (Express/Node, Nginx, Flask, Apache) so the 'when' clause also distinguishes the skill from generic web-server hardening guides.

DimensionReasoningScore

Specificity

"Configures HTTP security headers" names the domain with one concrete action; the protections listed (XSS, clickjacking, MIME sniffing) are purposes rather than distinct actions, so it stops short of the 'several specific actions' of anchor 4.

3 / 5

Completeness

A clear third-person 'what' ("Configures HTTP security headers to protect against XSS, clickjacking, and MIME sniffing") is paired with an explicit 'Use when...' clause listing concrete triggers, matching the anchor-5 example structure exactly.

5 / 5

Trigger Term Quality

Good natural keywords such as "hardening web applications", "security audits", and "Content Security Policy", but common synonyms users would say ("security headers", "CSP", "helmet", "HTTPS") are missing, falling short of anchor 5's comprehensive synonym coverage.

4 / 5

Distinctiveness Conflict Risk

"HTTP security headers" is a clear niche with distinct triggers (hardening, security audits, CSP); it is unlikely to fire for unrelated skills.

5 / 5

Total

17

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

secondsky/claude-skills

Path

plugins/security-headers-configuration/skills/security-headers-configuration/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.