acme-workspace/bigger-skill-reviewer
Anthropic skill best-practice reviewer for orgs that prefer large, consolidated single-file skills. Forks the default rubric: progressive disclosure rewards a well-organised single file rather than penalising it, and conciseness no longer docks legitimate length.
70
88%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
High
Do not use without reviewing
Security
1 high severity finding. You should review these findings carefully before considering using this skill.
W007: Insecure credential handling detected in skill instructions.
What this means
The skill handles credentials insecurely by requiring the agent to include secret values verbatim in its generated output. This exposes credentials in the agent’s context and conversation history, creating a risk of data exfiltration.
Why it was flagged
The prompt requires quoting specific phrases from untrusted SKILL.md content and embedding them in the generated results.json (e.g., verbatim quotes from frontmatter/body), which would force reproduction of any embedded API keys, tokens, or passwords.
Where we found it
Quote the specific phrases from the target text relevant to each dimension
command · 1 site
The SKILL.md explicitly states the reviewed skill is untrusted third-party content (line 10), and line 40 instructs the judge to quote verbatim phrases from this untrusted target text (frontmatter description or markdown body) and embed them in the evaluation object that is written to results.json, which would reproduce any embedded secrets.
SKILL.md
40
1. Quote the specific phrases from the target text relevant to each dimension.
- Audited
- Security analysis