axiom-scan-security-privacy

Use when the user mentions security review, App Store submission prep, Privacy Manifest requirements, hardcoded credentials, or sensitive data storage.

Quality

68%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

High

Do not use without reviewing

Fix and improve this skill with Tessl

tessl review fix ./axiom-codex/skills/axiom-scan-security-privacy/SKILL.md

Quality

Content

88%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is a lean, highly actionable audit workflow with concrete grep patterns, explicit validation checkpoints, and clear phase sequencing; its only real weakness is that everything lives inline in a single file with no progressive disclosure into reference bundles.

Suggestions

Extract the Phase 2 detection-pattern catalogue and the Phase 3 completeness table into a references/ file (e.g. DETECTION_PATTERNS.md) referenced from SKILL.md to improve progressive disclosure.

Move the Privacy Manifest API-category checklist and the compound-severity table into a separate reference to slim the main body.

Add a short 'Quick start' summary at the top pointing to each phase so navigation is explicit within the single file.

Dimension	Reasoning	Score
Conciseness	The body is dense and directive with no padding about concepts Claude already knows; every grep pattern, table, and fix earns its place. A few sections (compound-finding and completeness tables) are long, but information-dense, so it sits at 4 rather than 5.	4 / 5
Actionability	It provides copy-paste-ready grep regexes, exact file globs, named API symbols, and concrete fix guidance (e.g. 'Keychain with kSecAttrAccessibleWhenUnlockedThisDeviceOnly'); the common cases are fully executable.	5 / 5
Workflow Clarity	Five phases are explicitly sequenced with an embedded validation checkpoint ('use Read to verify the surrounding context before reporting — grep patterns have high recall but need contextual verification'), an evidence requirement, a completeness checklist table, and a compound-finding cross-reference step, satisfying the validation/feedback expectations.	5 / 5
Progressive Disclosure	The body is one well-organized file with clear ## section headers and a Related pointer to sibling skills; no bundle files exist to offload the detection-pattern or table content, so it is slightly heavier than ideal but appropriately structured, landing at 4.	4 / 5
	Total	18 / 20 Passed

Description

47%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is strong on explicit, natural trigger phrasing and distinctiveness, but it omits any statement of what the skill actually does, leaving the 'what' half of completeness unaddressed.

Suggestions

Lead with a concrete action clause before the triggers, e.g. 'Detects security and privacy issues in iOS codebases — hardcoded credentials, missing Privacy Manifests, insecure token storage, ATS violations, and logging leaks.'

Keep the existing 'Use when...' trigger list, but pair it with the 'what' so both halves of completeness are explicit.

Add a couple of common synonyms (secrets, tokens, keychain) to broaden trigger coverage.

Dimension	Reasoning	Score
Specificity	The description names the domain only implicitly via triggers ('security review', 'Privacy Manifest requirements', 'hardcoded credentials') but states no concrete actions the skill performs (e.g. scans, detects, reports). It matches the anchor 'Names the domain but actions are minimal or generic' — here actions are effectively absent, so it does not reach 3.	2 / 5
Completeness	It provides an explicit 'when' ('Use when the user mentions...') but no 'what' — nothing describes what the skill does. This matches the anchor 'only when is present without what', and cannot reach 3 because the what is entirely missing.	2 / 5
Trigger Term Quality	It lists several natural phrases users would say ('security review', 'App Store submission prep', 'Privacy Manifest requirements', 'hardcoded credentials', 'sensitive data storage'); a few common synonyms (secrets, tokens, keychain) are missing, so it stops short of 5.	4 / 5
Distinctiveness Conflict Risk	The triggers are specific to iOS App Store security and privacy, carving a clear niche with minimal overlap risk against non-iOS skills; minor overlap remains with a generic security-audit skill, keeping it below 5.	4 / 5
	Total	12 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: CharlesWiltgen/Axiom
Path: axiom-codex/skills/axiom-scan-security-privacy/SKILL.md
Commit: 69ffef6

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.