CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

axiom-security

Use when storing credentials securely, encrypting data, implementing passkeys, securing AI/agentic features against prompt injection, code signing, or managing certificates and provisioning profiles.

Quality

83%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Low

Low-risk findings worth noting

SKILL.md
Quality
Evals
Security

Quality

Content

85%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

An unusually well-built router skill: concrete routing (specific files, error codes, CLI commands), unambiguous decision logic with explicit conflict resolution against sibling suites, and ideal progressive disclosure that delegates all detail to one-level-deep sub-skill files. Its only real weakness is redundancy — the routing table, dot-graph tree, numbered tree, and example invocations restate the same mappings, inflating token cost without adding guidance.

Suggestions

Delete one of the two Decision Tree renderings — the dot graph and the numbered list encode identical routing; keep the numbered list (cheaper to scan) and cut ~20 lines.

Trim Example Invocations to the handful of phrasings not already covered by Quick Reference rows verbatim (e.g. keep the lock-screen intents and scanner cases, drop 'How do I store an auth token securely?' which restates an existing table row).

DimensionReasoningScore

Conciseness

Every line is information-dense with no concept explanations Claude already knows, but the same symptom-to-file routing is rendered up to four times: the Quick Reference table, the dot-graph Decision Tree, the numbered Decision Tree that fully duplicates the graph, and 13 Example Invocations that restate table rows (e.g. 'How do I store an auth token securely?' vs. the 'Store tokens, passwords, API keys securely' row). Roughly 60 of ~245 lines could be cut, which is 'mostly efficient but could be tightened' rather than the 'minor instances' of anchor 4 or the padded explanations of anchor 2.

3 / 5

Actionability

Routing guidance is fully concrete: exact paths ('skills/keychain-diag.md'), specific error-code triggers ('errSecDuplicateItem', 'errSecItemNotFound', 'errSecInteractionNotAllowed', 'CODESIGN', 'ITMS-90xxx'), named CLI commands ('security find-identity', 'security cms -D', 'codesign -d --entitlements'), and explicit agent-launch instructions (axiom_get_agent over MCP, or inline fallback via file search). Per the rubric's instruction-only note, absence of code is not penalized when guidance is actionable, and every common case has an unambiguous next action.

5 / 5

Workflow Clarity

This is a single-action router skill — diagnose the task, route to one file — and that action is unambiguous: the Quick Reference, Decision Tree, and Conflict Resolution rules ('CODESIGN, ITMS-90xxx, errSec → security') triangulate every case including boundary disputes with sibling suites. Per the simple-skill guidance a single unambiguous action earns the top score, and the skill involves no destructive or batch operations that would require validation checkpoints.

5 / 5

Progressive Disclosure

Exemplary router structure: no reference detail is inlined, and everything is delegated to clearly signaled one-level-deep files ('skills/keychain.md', 'skills/cryptokit-ref.md', 'skills/code-signing-diag.md') with a symptom-to-file Quick Reference for navigation and cross-suite pointers labeled with both suite and path ('See axiom-data (skills/grdb-app-groups.md) §4'). The referenced files live in the parent suite and were not present in this review bundle to verify, but the structure as written matches the anchor-5 pattern: concise overview plus well-signaled, one-level-deep references.

5 / 5

Total

18

/

20

Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description built on an explicit 'Use when' clause enumerating six concrete task domains with natural trigger terms and a clear security niche. It falls short of top marks only because the skill's 'what' is implied rather than separately stated, and a few sub-domains the body actually covers (keychain terminology, app attestation, file protection) lack trigger-term representation.

Suggestions

State the 'what' explicitly before the trigger clause, e.g. 'Provides reference patterns, API details, and troubleshooting guides for Apple-platform security work. Use when...'

Add the missing natural trigger term 'keychain' (users ask about Keychain/SecItem verbatim) plus synonyms like 'token storage' and 'biometric (Face ID/Touch ID) access'.

Mention app integrity / fraud prevention (App Attest) and file protection / data protection at rest, which the body covers with dedicated sub-skills but the description never names.

DimensionReasoningScore

Specificity

Names six concrete actions — 'storing credentials securely', 'encrypting data', 'implementing passkeys', 'securing AI/agentic features against prompt injection', 'code signing', 'managing certificates and provisioning profiles' — but omits sub-domains the body covers with dedicated files (app attestation/integrity, NSFileProtection/file protection at rest). This matches 'several specific actions; minor gaps in coverage' rather than the comprehensive anchor 5.

4 / 5

Completeness

The 'when' is explicit and highly specific ('Use when storing credentials securely, encrypting data, implementing passkeys, ...') and the embedded action list conveys the 'what', but the what is never stated separately as skill behavior (e.g. 'provides reference patterns and troubleshooting guides for...'). It sits just below the anchor-5 pattern that clearly and separately answers both, and well above anchor 4's example because the trigger list is concrete rather than generic.

4 / 5

Trigger Term Quality

Includes natural user phrases like 'implementing passkeys', 'prompt injection', 'code signing', and 'provisioning profiles', but misses 'keychain' — the suite's core technology and a term users say verbatim — plus synonyms such as token storage, biometric/Face ID access, and app integrity. Fits 'good keyword coverage; a few natural terms missing' rather than the synonym-complete anchor 5.

4 / 5

Distinctiveness Conflict Risk

Occupies a coherent security niche with distinctive triggers ('passkeys', 'provisioning profiles', 'prompt injection'), but 'storing credentials securely' and 'encrypting data' are broad enough to overlap with adjacent data-storage, cryptography, or networking skills — the body itself routes TLS pinning to axiom-networking. Matches 'mostly distinct; minor overlap risk with closely related skills' rather than the minimal-conflict anchor 5.

4 / 5

Total

16

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

referenced_paths_exist

Referenced path issues: 1 missing

Warning

Total

15

/

16

Passed

Repository

CharlesWiltgen/Axiom

Path

.claude-plugin/plugins/axiom/skills/axiom-security/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.