acme-workspace/bigger-skill-reviewer
Anthropic skill best-practice reviewer for orgs that prefer large, consolidated single-file skills. Forks the default rubric: progressive disclosure rewards a well-organised single file rather than penalising it, and conciseness no longer docks legitimate length.
70
88%
Does it follow best practices?
Impact
—
No eval scenarios have been run
Risky
Do not use without reviewing
Security
1 high severity finding. You should review these findings carefully before considering using this skill.
W007: Insecure credential handling detected in skill instructions
What this means
The skill handles credentials insecurely by requiring the agent to include secret values verbatim in its generated output. This exposes credentials in the agent’s context and conversation history, creating a risk of data exfiltration.
Why it was flagged
Insecure credential handling detected (high risk: 1.00). The prompt requires quoting specific phrases from untrusted SKILL.md content and embedding them in the generated results.json (e.g., verbatim quotes from frontmatter/body), which would force reproduction of any embedded API keys, tokens, or passwords.
- Audited
- Security analysis