axiom-scan-security-privacy

Use when the user mentions security review, App Store submission prep, Privacy Manifest requirements, hardcoded credentials, or sensitive data storage.

Quality

75%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

High

Do not use without reviewing

Fix and improve this skill with Tessl

tessl review fix ./axiom-codex/skills/axiom-scan-security-privacy/SKILL.md

Quality

Content

77%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with executable detection patterns and a well-sequenced, validation-checked workflow. Its weaknesses are length-driven redundancy and a fully monolithic structure with no reference files, which cost it on conciseness and progressive disclosure.

Suggestions

De-duplicate overlapping content between the Phase 3 completeness table, the Phase 4 compound-finding matrix, and the Output Format checklist so each section earns its tokens and conciseness moves toward 3.

Split stable reference material (the full pattern catalog and the output template) into a reference file under references/ and link to it one level deep, improving progressive disclosure from 2 to 3.

Consider moving the long compound-finding and false-positive tables into a reference doc, keeping SKILL.md as a tight overview of the five phases plus the most critical patterns.

Dimension	Reasoning	Score
Conciseness	The body is dense and operational with almost no conceptual padding, but at ~290 lines it carries redundancy — the Phase 3 question table, Phase 4 compound-finding matrix, and the Output Format's Privacy Manifest checklist restate overlapping material — so it could be tightened rather than earning a perfect 'every token earns its place'.	2 / 3
Actionability	It supplies directly executable detection patterns (e.g., `AKIA[0-9A-Z]{16}`, `sk-[a-zA-Z0-9]{24,}`, `apiKey.=."[^"]+"`), specific file globs, concrete Info.plist keys, and copy-paste-ready fixes like Keychain with `kSecAttrAccessibleWhenUnlockedThisDeviceOnly`.	3 / 3
Workflow Clarity	A clear five-phase sequence (Map → Detect → Reason → Cross-Reference → Score) with explicit verification checkpoints ('use Read to verify the surrounding context before reporting', 'Require evidence from the Phase 1 map'), error-handling guidance (Output Limits), and checklists (Privacy Manifest Checklist, Security Posture table).	3 / 3
Progressive Disclosure	No bundle files (references/scripts/assets) exist and the skill is a single ~290-line SKILL.md; content that could be split out — the long pattern catalog, the compound-finding matrix, and the full output template — is inline with no one-level-deep reference files to navigate to, so structure is good but disclosure is monolithic.	2 / 3
	Total	10 / 12 Passed

Description

72%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description has strong, natural trigger terms and a clear, distinctive niche, but it over-relies on triggers to convey capability without an explicit statement of what the skill does. Adding a concise capability clause before the 'Use when' trigger would raise completeness and specificity.

Suggestions

Lead with a concrete capability statement (e.g., 'Scans iOS projects for security/privacy issues and App Store rejection risks') before the 'Use when' clause so the 'what' is explicit, not implied.

Name specific actions the skill performs (detect hardcoded credentials, verify Privacy Manifest coverage, check ATS/HTTPS, validate ATT usage descriptions) to lift specificity from 2 to 3.

Keep the existing natural trigger terms — they are the description's strongest asset and should be preserved verbatim.

Dimension	Reasoning	Score
Specificity	The description names the security/privacy domain via trigger nouns ('security review', 'hardcoded credentials', 'sensitive data storage') but does not explicitly enumerate the concrete actions the skill performs (scan, detect, audit), so it stops short of listing multiple specific actions.	2 / 3
Completeness	The explicit 'Use when the user mentions...' clause clearly answers when, but the 'what' (what the skill does) is only implied through trigger nouns rather than stated as a concrete capability, so it does not clearly answer both.	2 / 3
Trigger Term Quality	It surfaces natural phrases users would actually say — 'security review', 'App Store submission prep', 'Privacy Manifest requirements', 'hardcoded credentials', 'sensitive data storage' — giving good coverage of common variations.	3 / 3
Distinctiveness Conflict Risk	The iOS/App Store security niche with triggers like 'Privacy Manifest requirements' and 'App Store submission prep' is clearly distinct and unlikely to fire for unrelated skills.	3 / 3
	Total	10 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: CharlesWiltgen/Axiom
Path: axiom-codex/skills/axiom-scan-security-privacy/SKILL.md
Commit: ea3be7c

Reviewed: 1 day ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.