CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

axiom-security

Use when storing credentials securely, encrypting data, implementing passkeys, securing AI/agentic features against prompt injection, code signing, or managing certificates and provisioning profiles.

Quality

72%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./axiom-codex/skills/axiom-security/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

67%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-built router skill: highly actionable symptom-to-reference routing, clear decision logic, and strong progressive disclosure with per-topic summaries that tell the model what each reference contains without inlining it. The main cost is redundancy — the decision tree appears twice and Example Invocations restates the Quick Reference — and a handful of unverifiable or path-less external references.

Suggestions

Drop either the dot-graph decision tree or the numbered list — they state the identical mapping, and the numbered list alone saves ~20 lines with no loss.

Trim or cut the Example Invocations section, which restates the Quick Reference mapping a third time; a few representative examples would preserve the natural-phrasing signal at a fraction of the tokens.

Give external skill references a consistent, actionable form (e.g. the '/skill <name>' syntax used for axiom-shipping) instead of bare 'See axiom-build' / 'See axiom-payments suite'.

DimensionReasoningScore

Conciseness

The body is dense routing information with no explanations of concepts Claude already knows, but the same symptom-to-file mapping is rendered four times: the dot graph exactly duplicates the numbered decision tree, and the ~40-line Example Invocations section largely duplicates the Quick Reference table. This is 'mostly efficient but could be tightened' (anchor 3) rather than clearly padded enough for anchor 2.

3 / 5

Actionability

Concrete, executable routing throughout — an exact reference file per symptom, real CLI commands ("security find-identity", "codesign -d --entitlements"), and a scanner invocation. Minor gaps: some destinations are vague ("See axiom-payments suite", "See axiom-build" with no path or skill invocation syntax), keeping it below anchor 5.

4 / 5

Workflow Clarity

The task-to-reference selection sequence is clear and unambiguous via the numbered decision tree and the conflict-resolution if/then rules with concrete error-code signals (CODESIGN, ITMS-90xxx, errSec). No validation checkpoints are needed since the skill routes rather than performs destructive operations, so anchor 4 fits; anchor 5's feedback loops are not applicable to a router.

4 / 5

Progressive Disclosure

Good structure with well-signaled, one-level-deep references organized by topic and a quick-reference table up front. Minor gaps: no bundle files are present to verify the skills/*.md paths resolve, several references point to external skills without paths (axiom-build, axiom-shipping, axiom-payments), and the inline Codex-porting comment block adds noise — anchor 4 rather than 5.

4 / 5

Total

15

/

20

Passed

Description

66%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description has strong, explicit trigger guidance with concrete, natural security terminology and a clear niche. Its main weakness is that it is purely a 'Use when…' clause: the skill's actual function is only implied, and several natural trigger synonyms (keychain, API keys, secrets) are absent.

Suggestions

Add a leading 'what' clause before the 'Use when' clause, e.g. 'Routes Apple-platform security and credentials work to reference guides for keychain, CryptoKit, passkeys, app attestation, and code signing. Use when…' so both what and when are explicit.

Include the natural synonyms users actually say: 'keychain', 'API keys', 'tokens', 'secrets', and 'App Attest' are all covered by the body but absent from the description.

Mention keychain error troubleshooting (errSecDuplicateItem, errSecItemNotFound) — a common entry point visible in the body's examples but missing from the description.

DimensionReasoningScore

Specificity

Lists several concrete actions ("storing credentials securely", "implementing passkeys", "code signing", "managing certificates and provisioning profiles") but omits coverage areas present in the body (keychain error diagnostics, app attestation, file protection), so it falls short of the comprehensive anchor 5.

4 / 5

Completeness

The explicit "Use when…" clause answers 'when' clearly, but the description is only a when-clause — what the skill actually does (route to per-topic security reference guides) is never stated, only weakly implied by the gerund list. Scoring only what is explicit, this matches anchor 3's 'one present, the other weakly implied' better than anchor 4's 'both present'.

3 / 5

Trigger Term Quality

Good natural-keyword coverage ("passkeys", "prompt injection", "provisioning profiles", "code signing", "encrypting data") that users would plausibly say, but common synonyms like "keychain", "API keys", "tokens", and "secrets" are missing, matching anchor 4 rather than anchor 5's comprehensive synonym coverage.

4 / 5

Distinctiveness Conflict Risk

A clear Apple-platform security niche with distinct triggers (passkeys, provisioning profiles, prompt injection) gives minimal conflict risk, but broad phrases like "encrypting data" and "securing AI/agentic features" could overlap with general cryptography or AI-safety skills, matching anchor 4 rather than 5.

4 / 5

Total

15

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

referenced_paths_exist

Referenced path issues: 1 missing

Warning

Total

15

/

16

Passed

Repository

CharlesWiltgen/Axiom

Path

axiom-codex/skills/axiom-security/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.