Content
85%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A tight, well-structured review-lens skill: every section adds non-obvious guidance and the threshold gate prevents false positives. The two weaknesses are minor — a duplicated exploit-path rule across Method and Threshold, and the absence of one or two example findings that would make the reporting format fully concrete.
Suggestions
Consolidate the duplicate exploit-path rule: state the 'no finding without a named actor, controlled input, and reachable sink' requirement once (e.g., in Threshold) and remove the near-identical sentence from Method.
Add one or two compact example findings showing the required reporting format in action (e.g., an authorization finding naming the actor, missing scope check, exposed data, and smallest fix).
Optionally note in Method how to handle chained/indirect sinks concretely (e.g., input reaching a query builder, template, or eval path) to sharpen the trace step.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is lean and assumes Claude's competence (no concept tutorials, no library recommendations), but the exploit-path requirement is stated twice — "Do not report a security smell without an exploit path through the changed code" in Method and "Do not report hypothetical risks without a plausible path through the changed code" in Threshold — a minor redundancy that could be consolidated into one section. | 4 / 5 |
Actionability | Concrete directive guidance throughout: the reporting format names required evidence elements ("the untrusted input or controlled authority, the sink or disclosure it reaches, and the impact") and cites concrete fix patterns ("validate at this boundary, parameterize this query, escape this output, move this secret to config"). It falls short of anchor 5 only because there are no worked example findings covering common cases. | 4 / 5 |
Workflow Clarity | A clear, coherent sequence — start at boundaries, trace untrusted input, follow data outward, apply the Threshold gate (exploit path required before reporting), then report in the specified format. This is a single-purpose skill under 50 lines with an unambiguous action and an explicit checkpoint, so the simple-skill exception applies. | 5 / 5 |
Progressive Disclosure | A 36-line skill with no need for external references and no bundle files present; the four well-organized sections (Scope, Method, Threshold, Reporting) are appropriately placed inline, satisfying the under-50-lines exception for a 5. | 5 / 5 |
Total | 18 / 20 Passed |