nemoclaw-maintainer-security-code-review

Review a PR, or a PR linked to an issue, for security risks. Check nine categories and report PASS, WARNING, or FAIL. Use when reviewing code for vulnerabilities, secrets, injection, authorization bypasses, or unsafe configuration. Trigger keywords - security review, code review, appsec, vulnerability assessment, security audit, review PR security.

Quality

95%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Quality

Content

96%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is a tight, fully executable six-step workflow with strong validation checkpoints and a defined report format. The only gap is the reference to ../_shared/security-rubric.md, which is not shipped in the bundle, leaving one navigation link dangling.

Suggestions

Ship the referenced ../_shared/security-rubric.md inside the skill bundle (e.g. under references/) and update the link, so the canonical rubric is reachable at review time.

Consider listing the nine security category names inline in Step 5 (or a short table) so the reviewer has the category set even before opening the shared rubric.

Add a brief note on how to obtain the PR base branch once and reuse it, to avoid repeating the `gh pr view --json baseRefName` lookup in later steps.

Dimension	Reasoning	Score
Conciseness	The body is lean and assumes Claude's competence — it never explains what a PR or security category is, and every line is either a command, a sequencing instruction, or a report-format spec. It does not drift toward the over-explanation seen in the lower anchors.	5 / 5
Actionability	It provides fully executable, copy-paste-ready `gh` and `git` commands for every step (e.g. `gh pr view <number> --repo OWNER/REPO --json number,url`, `git diff main...HEAD --name-status`) with a concrete file-priority list and a defined report table, covering the common cases.	5 / 5
Workflow Clarity	The six-step sequence has explicit validation checkpoints and stop conditions: Step 1 verifies exactly one open PR and stops otherwise, Step 2 verifies the repo match before checkout, Step 3 confirms the base branch, and the Important Notes define stop conditions for empty or non-applicable PRs — matching the validate/feedback-loop anchor.	5 / 5
Progressive Disclosure	Structure is well-organized with one clearly signaled one-level reference ("Read the canonical [Security Rubric](../_shared/security-rubric.md)"), but that referenced file is not present in the skill bundle, so navigation is slightly incomplete rather than fully clean.	4 / 5
	Total	19 / 20 Passed

Description

95%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is strong: it states a clear what, an explicit Use-when trigger with concrete keywords, and a narrow, distinctive security-review niche. The only slight gap is that the concrete actions are summarized rather than enumerated in full.

Dimension	Reasoning	Score
Specificity	It names the domain and concrete actions — "Review a PR... for security risks", "Check nine categories and report PASS, WARNING, or FAIL" — but the action set is narrow (review + verdict) rather than a comprehensive enumeration of capabilities, so it sits below the score-5 anchor.	4 / 5
Completeness	It answers both what ("Review a PR... for security risks... Check nine categories and report PASS, WARNING, or FAIL") and when with an explicit "Use when reviewing code for vulnerabilities, secrets, injection, authorization bypasses, or unsafe configuration" clause and concrete trigger phrases.	5 / 5
Trigger Term Quality	It gives explicit, natural trigger keywords users would actually say — "security review, code review, appsec, vulnerability assessment, security audit, review PR security" — covering synonyms and common phrasings comprehensively.	5 / 5
Distinctiveness Conflict Risk	The security-PR-review niche is clearly bounded by both its domain (nine security categories) and distinct trigger keywords ("appsec", "vulnerability assessment", "security audit"), giving it minimal overlap with general code-review skills.	5 / 5
	Total	19 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning
relative_links	Relative link issues: 1 suspicious	Warning

	Total	14 / 16 Passed

Repository: NVIDIA/NemoClaw
Path: .agents/skills/nemoclaw-maintainer-security-code-review/SKILL.md
Commit: e987b00

Reviewed: about 3 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.