agent-security-review

Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.

Quality

52%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./.agent/skills/agent-security-review/SKILL.md

Quality

Content

22%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

This skill is essentially a hollow table of contents with no actionable content in the main file. It lists 11 sub-skill references but provides zero concrete guidance, no security patterns, no code examples, and an empty checklist section. Without the sub-skill files (which aren't provided in the bundle), the skill delivers no value on its own.

Suggestions

Add a concise quick-reference security checklist under the empty '## Security Checklist' heading with concrete, actionable items (e.g., 'Always use parameterized queries', 'Never log secrets', 'Validate all user input at API boundaries').

Include at least 2-3 executable code examples for the most critical patterns (e.g., parameterized SQL query, input sanitization, secrets from environment variables) so the main file is useful even without sub-skills.

Define a clear security review workflow with validation steps, e.g., '1. Check secrets handling → 2. Audit input validation → 3. Review auth boundaries → 4. Run automated security tests → 5. Verify no sensitive data in logs/responses'.

Remove the redundant numbering in sub-skill links (e.g., '### 1. [1. Secrets Management]' → '### [Secrets Management]') and add a one-line description for each sub-skill so readers know when to consult each file.

Dimension	Reasoning	Score
Conciseness	The content is relatively brief, but the 'When to Activate' section lists things Claude could infer, and the numbered list of sub-skills has redundant numbering (both in heading and link text). The checklist header is empty, adding no value.	2 / 3
Actionability	The skill body contains zero concrete code, commands, examples, or executable guidance. It is entirely a table of contents pointing to sub-skill files with no actionable content in the main file itself—not even a single security pattern or quick-reference rule.	1 / 3
Workflow Clarity	There is no workflow, sequence, or process described. The '## Security Checklist' heading is empty with no checklist items. For a skill involving security reviews of destructive/sensitive operations, the complete absence of validation steps or a review process is a significant gap.	1 / 3
Progressive Disclosure	The skill does reference 11 sub-skill files with clear one-level-deep links, which is good structure. However, no bundle files were provided to verify these references exist, the main file provides zero overview content for any topic (making it impossible to use without the sub-files), and the empty 'Security Checklist' heading suggests incomplete organization.	2 / 3
	Total	6 / 12 Passed

Description

82%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description has good trigger term coverage and explicitly addresses both 'what' and 'when', making it functional for skill selection. However, the actual capabilities are described vaguely ('comprehensive security checklist and patterns') rather than listing specific concrete actions, and the broad scope across authentication, input handling, APIs, and payments creates overlap risk with more specialized skills. The description also uses second person voice ('Use this skill') which is a minor style issue.

Suggestions

Replace 'Provides comprehensive security checklist and patterns' with specific actions like 'Validates input sanitization, configures CSRF protection, implements secret rotation, audits authentication flows'.

Narrow the scope or add distinguishing qualifiers to reduce overlap — e.g., clarify this is a security review/audit skill rather than an implementation skill for APIs or auth.

Dimension	Reasoning	Score
Specificity	Names the domain (security) and lists several areas (authentication, secrets, API endpoints, payment features), but the actual actions are vague — 'Provides comprehensive security checklist and patterns' doesn't describe concrete actions like 'validates input against injection attacks' or 'encrypts secrets at rest'.	2 / 3
Completeness	Explicitly answers both 'when' ('Use this skill when adding authentication, handling user input, working with secrets...') and 'what' ('Provides comprehensive security checklist and patterns'). The 'Use when' clause is present and detailed.	3 / 3
Trigger Term Quality	Includes strong natural trigger terms users would actually say: 'authentication', 'user input', 'secrets', 'API endpoints', 'payment', 'sensitive features'. These cover a good range of security-related queries.	3 / 3
Distinctiveness Conflict Risk	While the security focus is somewhat distinct, terms like 'handling user input', 'creating API endpoints', and 'authentication' could easily overlap with general web development, API design, or authentication-specific skills. The scope is broad enough to risk false triggers.	2 / 3
	Total	10 / 12 Passed

Validation

90%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 10 / 11 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	10 / 11 Passed

Repository: Dokhacgiakhoa/antigravity-ide
Path: .agent/skills/agent-security-review/SKILL.md
Commit: c4a059b

Reviewed: 1 day ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.