fix-security-issue

Implement a fix for a reviewed security issue. Takes a directly requested issue number or scans for issues labeled `topic:security` and `agent:implementation-requested`. Reads the security review from the issue comments and implements the remediation plan. Trigger keywords - fix security issue, remediate security, implement security fix, patch vulnerability.

Quality

94%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Quality

Content

88%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a well-structured, highly actionable nine-step workflow with strong validation checkpoints and executable commands throughout. Its main weakness is moderate repetition of the label/mode-handling logic across several steps.

Suggestions

Consolidate the repeated agent:implementation-requested / direct-vs-queue label guidance into a single shared section and reference it from Steps 1, 2, 4, and 8 to reduce duplication.

Consider moving the lengthy PR description heredoc template and the example-usage scenarios into a references/ file to keep SKILL.md as a lean overview.

Make the Step 6 test-run block concrete (it currently says 'the specific command depends on the project') or link to a project test-runner reference, since other steps provide explicit commands.

Dimension	Reasoning	Score
Conciseness	The body is largely lean and actionable with no padding about concepts Claude already knows, but the agent:implementation-requested / direct-vs-queue label handling is restated across Steps 1, 2, 4, and 8, which could be consolidated.	4 / 5
Actionability	Provides copy-paste-ready, executable commands throughout — gh issue list/view, git checkout -b, mise run pre-commit, and a full heredoc gh pr create body — covering the common cases concretely.	5 / 5
Workflow Clarity	Nine clearly sequenced steps with explicit validation checkpoints (label validation, review-determination checks, pre-commit 'fix before proceeding', test verification) and stop conditions for each failure path, including feedback loops for the destructive PR-creation workflow.	5 / 5
Progressive Disclosure	No bundle files exist, so the single SKILL.md carries everything; it is well-organized into clearly headed sections plus a commands reference table and examples, though the large PR-body template and example scenarios could optionally be split into reference files.	4 / 5
	Total	18 / 20 Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is third-person, concise, and explicitly covers both what the skill does and when to use it with natural trigger keywords. It is highly specific and clearly distinguishable from sibling skills via its label-gated workflow.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'Implement a fix', 'Takes a directly requested issue number or scans for issues labeled', 'Reads the security review from the issue comments and implements the remediation plan' — giving comprehensive, specific coverage rather than vague abstraction.	5 / 5
Completeness	Explicitly answers both 'what' (implement a fix for a reviewed security issue by reading the review and applying the remediation plan) and 'when' (concrete 'Trigger keywords -' clause), matching the level-5 anchor.	5 / 5
Trigger Term Quality	Provides natural trigger phrases users would say — 'fix security issue, remediate security, implement security fix, patch vulnerability' — with synonym-level coverage; not merely technical jargon.	5 / 5
Distinctiveness Conflict Risk	Scoped to 'reviewed security issue' with specific labels (topic:security, agent:implementation-requested) and a dependency on the review-security-issue skill, giving it a clear niche with minimal conflict risk.	5 / 5
	Total	20 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
metadata_field	'metadata' should map string keys to string values	Warning

	Total	14 / 16 Passed

Repository: NVIDIA/OpenShell
Path: .agents/skills/fix-security-issue/SKILL.md
Commit: 292559c

Reviewed: 5 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.