Content
64%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
This is a well-structured security audit skill that covers a broad attack surface efficiently. Its main strengths are the concise scoring impact table, specific grep patterns, and clear severity classifications. Its weaknesses are heavy reliance on unverifiable reference files for core actionable content and the lack of explicit validation/feedback loops for a process that involves destructive remediation steps (credential rotation, history purging).
Suggestions
Add a brief validation/feedback loop workflow, e.g., 'After each P0 finding: 1. Document finding, 2. Apply fix, 3. Re-run scan to verify remediation, 4. Proceed to next section.'
Inline at least one concrete example command for sections 1-3 and 5 so the SKILL.md is minimally actionable without the reference files (e.g., a key grep pattern for secrets scanning).
Ensure bundle files (references/implementation.md, references/mobile-audit.md, references/REMEDIATION.md) are actually provided so the progressive disclosure structure is functional.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The content is lean and efficient. It avoids explaining what secrets, injection, or CVEs are—concepts Claude already knows. Each section is tightly scoped with specific commands or clear pointers to reference files. The scoring table is a compact, high-value addition. | 3 / 3 |
Actionability | Sections 4, 6, and 8 provide concrete commands and specific patterns to grep for, which is good. However, sections 1, 2, 3, 5, and 7 delegate entirely to reference files (which are not provided in the bundle), making the SKILL.md itself incomplete for execution. The mix of concrete and delegated guidance lands this at a 2. | 2 / 3 |
Workflow Clarity | The numbered sections imply a sequence (scan secrets first, then logs, then injection, etc.), and the scoring table provides clear thresholds. However, there are no explicit validation checkpoints, no feedback loops for when findings are discovered (beyond the brief 'rotate NOW' note), and no clear workflow for iterating through findings and verifying fixes. | 2 / 3 |
Progressive Disclosure | The skill references multiple external files (references/implementation.md, references/mobile-audit.md, references/REMEDIATION.md) with clear signaling, which is good structure. However, no bundle files were provided, so we cannot verify these references exist or are well-structured. Additionally, some sections inline content while others delegate entirely, creating an inconsistent pattern. | 2 / 3 |
Total | 9 / 12 Passed |