fix-security-issue

Implement a fix for a reviewed security issue. Takes an issue number or scans for issues labeled "topic:security" and "state:agent-ready". Reads the security review from the issue comments and implements the remediation plan. Trigger keywords - fix security issue, remediate security, implement security fix, patch vulnerability.

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Quality

Content

77%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The skill body is highly actionable with an excellent validated workflow, but it is somewhat verbose for its length and keeps everything in a single monolithic file rather than offloading detail to references.

Suggestions

Remove or trim the 'Useful Commands Reference' table since every command already appears inline in the relevant step.

Reduce the five 'Example Usage' scenarios to one or two representative ones; the step sequence already conveys the flow.

Move the long PR-description template and/or the example scenarios into a referenced file (e.g. references/pr-template.md) to improve progressive disclosure.

Dimension	Reasoning	Score
Conciseness	The body is directive and free of concept-explanation padding, but the 'Useful Commands Reference' table largely duplicates inline commands and the five 'Example Usage' scenarios restate the already-detailed step sequence, so it could be tightened.	2 / 3
Actionability	Provides copy-paste-ready, executable gh/git/mise commands and a full heredoc PR body template; the only non-executable snippet (test runner) is explicitly justified by per-project variability.	3 / 3
Workflow Clarity	A clear nine-step sequence with explicit validation gates — the label check is a 'hard gate', review-determination checks, 'Fix any issues that arise before proceeding' — gives strong feedback loops for a destructive/batch-style operation.	3 / 3
Progressive Disclosure	Well-organized into clear sections, but the file is monolithic at ~310 lines with no bundle references; the long PR-body template and example set are inline content that could be split into referenced files.	2 / 3
	Total	10 / 12 Passed

Description

100%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, action-oriented, and supplies explicit trigger keywords plus a clear what/when pair. It is concise and clearly distinct from neighboring skills.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'Takes an issue number or scans for issues labeled...', 'Reads the security review from the issue comments and implements the remediation plan' — rather than vague language.	3 / 3
Completeness	Answers both 'what' (implement a fix for a reviewed security issue, read the review, implement the remediation plan) and 'when' via explicit trigger-keyword guidance, satisfying the 'Use when...' equivalent requirement.	3 / 3
Trigger Term Quality	Explicit 'Trigger keywords - fix security issue, remediate security, implement security fix, patch vulnerability' gives good coverage of natural phrases a user would say.	3 / 3
Distinctiveness Conflict Risk	Niche is clearly scoped to already-reviewed security issues with specific labels and a remediation plan, with distinct triggers unlikely to conflict with other skills.	3 / 3
	Total	12 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: NVIDIA/OpenShell
Path: .agents/skills/fix-security-issue/SKILL.md
Commit: deced87

Reviewed: 6 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.