CtrlK
BlogDocsLog inGet started
Tessl Logo

security-review

Review trust boundaries, auth/authz, injection, secrets, filesystem/network exposure, dependencies, and exploitability without pretending a shallow lint is an audit.

56

Quality

65%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./crates/tui/assets/skills/security-review/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

72%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is concise and well-structured for a simple skill, but its workflow steps are high-level directives without concrete tooling, checklists, or validation/verification checkpoints. Adding actionable specifics and a verification loop would meaningfully raise quality.

Suggestions

Add concrete, executable guidance per step — e.g., specific tools or commands for secret scanning (e.g., `gitleaks`), dependency review, or injection checks — rather than only naming the category.

Insert an explicit validation/verification checkpoint in the workflow, such as confirming each recommended fix actually remediates its finding before ranking closes.

Provide a short ranking rubric or severity criteria so findings are ranked consistently rather than by unspecified judgment.

DimensionReasoningScore

Conciseness

The body is lean and assumes Claude's competence: brief 'When to use', 'Non-goals', and a four-step workflow with no padding or explanation of concepts Claude already knows.

5 / 5

Actionability

It names what to check (auth/authz, injection, secrets, FS/network exposure, deps) and to rank findings and recommend fixes, but gives no specific tools, commands, checklists, or concrete steps on how to perform each check.

3 / 5

Workflow Clarity

A clear four-step sequence is present, but it lacks explicit validation checkpoints (e.g., verifying a fix actually closes the finding), which caps workflow clarity at 3 for a review-with-fixes workflow.

3 / 5

Progressive Disclosure

Under 50 lines, single-purpose, with well-organized sections (When to use / Non-goals / Workflow) and no need for external references; the simple-skill exception applies.

5 / 5

Total

16

/

20

Passed

Description

58%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is domain-specific and comprehensive in naming review areas, but lacks an explicit 'Use when...' trigger clause and natural trigger synonyms, which cap completeness and trigger-term quality. It is concise and clearly distinct from unrelated skills.

Suggestions

Add an explicit 'Use when...' clause naming concrete user triggers, e.g., 'Use when reviewing code for vulnerabilities, security holes, secret leaks, or unsafe trust boundaries.'

Include natural trigger synonyms users actually say, such as 'security audit', 'pentest', or 'CVE', to improve trigger-term coverage.

Vary the verbs beyond a single 'Review' to name distinct actions (e.g., 'Identify', 'Rank', 'Recommend fixes') for stronger specificity.

DimensionReasoningScore

Specificity

The description enumerates seven concrete review areas (trust boundaries, auth/authz, injection, secrets, FS/network exposure, deps, exploitability), giving broad coverage, but applies a single verb ('Review') across the list rather than naming multiple distinct actions.

4 / 5

Completeness

It clearly states 'what' the skill does but provides no explicit 'Use when...' trigger clause in the description itself; per the judging guideline a missing explicit trigger caps completeness at 3.

3 / 5

Trigger Term Quality

It includes some relevant keywords ('auth holes', 'secret leaks', 'trust boundaries') but misses common natural synonyms and variations users might say, such as 'security audit', 'pentest', or 'CVE'.

3 / 5

Distinctiveness Conflict Risk

The security-review niche is mostly distinct with clear triggers, though it has minor overlap risk with a generic code-review skill.

4 / 5

Total

14

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository
Hmbown/CodeWhale
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.