Content
70%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The body delivers an exceptionally concrete, well-sequenced audit workflow with real validation loops — the strongest part of the skill. Its weaknesses are duplication between the Workflow and Rules sections (the step-0 foundation check appears nearly verbatim twice) and a dangling dependency on content/convex-expert.md, which the hardening step requires verbatim but which is absent from the bundle.
Suggestions
Deduplicate the foundation check: the first Rules bullet restates workflow step 0 almost word-for-word — keep one canonical statement and cross-reference it ('see step 0') from the other location.
Ship the canonical pattern: either add content/convex-expert.md (or the requireIdentity/requireOwner code) to the bundle's references/ or inline the ~10-line helpers, since the hardening step instructs applying them 'verbatim' from a file that is not present.
Make the scan fully deterministic: only shape (a) has an actual regex; provide the grep patterns (or the exact commands) for shapes b–d so the 'objective, regex-based' scan step is reproducible without re-deriving the prose conditions.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | Mostly efficient with real tightening available: the step-0 foundation check is restated nearly verbatim as the first bullet in Rules, shape (d) is explained twice (workflow step and rule), and the intro's defect tally ('25 identity-from-arg + 13 missing-ownership-check + 6 PII-leak-by-argument = 44 of 214 confirmed defects') is padding. No time is wasted explaining concepts Claude already knows, so this stays above anchor 2. | 3 / 5 |
Actionability | Highly concrete — an executable regex for shape (a), exact helper semantics ('requireIdentity(ctx) (throws 401 if ctx.auth.getUserIdentity() is null)', 'throws 404 if doc is null, throws 403 if doc.ownerId !== identity.subject'), and the exact command 'npx tsc --noEmit'. Falls short of anchor 5 because shapes b–d get prose descriptions instead of the deterministic greps the scan step promises, and the 'apply verbatim' pattern from content/convex-expert.md is never shown. | 4 / 5 |
Workflow Clarity | Steps 0–4 are clearly sequenced with explicit validation checkpoints ('run npx tsc --noEmit… a hardening pass that doesn't typecheck is not done', 're-run the step-1 scan to confirm 0 remaining hits') and an explicit error-recovery branch for foundationless apps (internalize-and-defer with a user message). This matches the anchor: clear sequence, explicit validation, feedback path for the failure case. | 5 / 5 |
Progressive Disclosure | Section structure (Workflow, Rules) is good and the skill is self-contained in one file, but it twice instructs applying the canonical pattern 'from content/convex-expert.md verbatim' — a file that is not shipped in the bundle (no references/ directory exists). A load-bearing external reference that doesn't resolve is more than the 'minor organization gaps' of anchor 4, but the structure is otherwise solid, keeping this above anchor 2. | 3 / 5 |
Total | 15 / 20 Passed |