CtrlK
BlogDocsLog inGet started
Tessl Logo

security-review

Review trust boundaries, auth/authz, injection, secrets, filesystem/network exposure, dependencies, and exploitability without pretending a shallow lint is an audit.

64

Quality

77%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./crates/tui/assets/skills/security-review/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

72%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is admirably concise and well-organized for a simple skill, but its workflow is high-level and lacks the concrete methods and validation checkpoints that would make it fully actionable.

Suggestions

Add a concrete checklist under each workflow step (e.g. specific things to look for under 'injection': SQL/ORM query construction, shell command composition, template/eval usage).

Insert a validation checkpoint, e.g. between steps 2 and 3: 'Confirm each finding has a reachable attack path before ranking; discard unexploitable items.'

Optionally point to a bundled checklist or reference file for the per-category items to keep SKILL.md lean while raising actionability.

DimensionReasoningScore

Conciseness

The body is lean with no concept-padding or explanation Claude already knows — every section (When to use, Non-goals, Workflow) earns its place — matching the level-3 anchor; it is not level 2 because there is no unnecessary explanation to tighten.

3 / 3

Actionability

It names concrete concern categories ('auth/authz, injection, secrets, FS/network exposure, deps') but gives no concrete method, command, or checklist for how to check each, so it describes more than it instructs; not level 1 because the categories are specific rather than fully vague, and not level 3 because nothing is copy-paste ready.

2 / 3

Workflow Clarity

The four steps are clearly sequenced, but there is no explicit validation checkpoint or feedback loop between mapping, checking, and ranking findings; per the rubric, a multi-step process without validation checkpoints caps at 2, and this is not a single-action skill so the simple-skill exception does not apply.

2 / 3

Progressive Disclosure

At well under 50 lines with no need for external references, the well-organized sections (When to use, Non-goals, Workflow) satisfy the simple-skill allowance for a level-3 score; no bundle files exist, so there are no nested references to penalize.

3 / 3

Total

10

/

12

Passed

Description

82%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and trigger-rich for the security domain, but its lack of an explicit 'Use when...' clause caps completeness at 2 even though it otherwise reads well.

Suggestions

Add an explicit 'Use when...' clause to the description, e.g. 'Use when the user asks for a security review, to find vulnerabilities, or to check for secret leaks and unsafe trust boundaries.'

Include a couple of plain-user phrasings ('vulnerabilities', 'security holes') so the trigger terms match what users actually say.

DimensionReasoningScore

Specificity

It enumerates multiple concrete review targets — 'trust boundaries, auth/authz, injection, secrets, filesystem/network exposure, dependencies, and exploitability' — matching the 'lists multiple specific concrete actions' anchor; not the level below which only names a domain and a few actions.

3 / 3

Completeness

It clearly answers 'what' (review the listed security concerns) but the description lacks a 'Use when...' clause or equivalent explicit trigger, which the guideline says should cap completeness at 2; it cannot reach 3 without an explicit when-trigger.

2 / 3

Trigger Term Quality

Terms a user would naturally say — 'secrets', 'injection', 'auth', 'audit', 'trust boundaries' — give good coverage, matching the level-3 anchor; it is not reduced to level 2 because common variations are present rather than missing.

3 / 3

Distinctiveness Conflict Risk

Security review is a clear niche with distinct triggers (trust boundaries, secrets, injection) unlikely to fire for unrelated skills; not level 2, which would still overlap noticeably with sibling skills.

3 / 3

Total

11

/

12

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository
Hmbown/CodeWhale
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.