review-security-issue

Given a GitHub issue, review the issue for security implications. You'll make a determination if the claim in the issue is legitimate and should be addressed or will be a "won't fix." Trigger keywords - security issue, review security ticket, review security issue.

Quality

95%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Quality

Content

100%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is concise, fully actionable with executable gh commands and copy-paste comment templates, and structured as a clear six-step workflow with branching checkpoints. It is a well-organized single-file skill with no progressive-disclosure issues.

Dimension	Reasoning	Score
Conciseness	The body is lean and efficient — concrete `gh` commands and heredoc templates with no explanation of concepts Claude already knows (e.g., no 'what is a security issue' preamble), matching the score-3 'every token earns its place' anchor; it is not 2 because there is no unnecessary padding, only functional template content.	3 / 3
Actionability	Quotes fully executable commands such as 'gh issue view <id> --json title,body,state,labels,author', 'gh issue view <id> --json comments --jq ".comments[].body"', and ready-to-use heredoc comment bodies, matching the score-3 'copy-paste ready' anchor; it is not 2 because the guidance is concrete and complete, not pseudocode.	3 / 3
Workflow Clarity	Quotes a clear six-step sequence with explicit checkpoints — Step 2 branches on the agent marker and the 'state:agent-ready' label (done / address follow-ups / proceed to Step 3) and Step 4 splits legitimate vs not-actionable paths — matching the score-3 'explicit validation steps' anchor; it is not 2 because validation checkpoints and branching are present and explicit.	3 / 3
Progressive Disclosure	The skill is a single well-organized SKILL.md with clearly labeled sections (Prerequisites, Agent Comment Marker, Steps 1-6, Useful Commands Reference, Example Usage) and no external bundle files, matching the score-3 simple-skill case via the rubric's 'under 50 lines / no need for external references' note; it is not 2 because organization is clean and there are no nested or poorly-signaled references.	3 / 3
	Total	12 / 12 Passed

Description

90%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description clearly states what the skill does and when to use it, with concrete trigger keywords and a distinct niche. Its only weakness is second-person voice ('You'll make a determination'), which the rubric penalizes on specificity.

Suggestions

Rewrite in third person to avoid the voice penalty: e.g., 'Given a GitHub issue, reviews it for security implications and determines whether the claim is legitimate and should be addressed or marked "won't fix".'

Tighten the trigger-keyword phrasing into a natural 'Use when...' clause, e.g., 'Use when reviewing a security issue, security ticket, or vulnerability report on GitHub.'

Dimension	Reasoning	Score
Specificity	Quotes 'review the issue for security implications' and 'make a determination if the claim in the issue is legitimate and should be addressed or will be a "won't fix"' list multiple concrete actions (score-3 anchor), but the second-person 'You'll make a determination' triggers the rubric's −1 voice penalty, reducing it to 2; it is not 1 because concrete actions are clearly named.	2 / 3
Completeness	Quotes both the 'what' ('review the issue for security implications' + 'make a determination...legitimate...won't fix') and the explicit 'when' trigger clause ('Trigger keywords - security issue, review security ticket, review security issue'), matching the score-3 anchor for explicit triggers; it is not 2 because 'when' is stated explicitly, not merely implied.	3 / 3
Trigger Term Quality	Quotes 'Trigger keywords - security issue, review security ticket, review security issue' giving good coverage of natural terms a user would say, matching the score-3 anchor; it is not 2 because common variations are well represented rather than partially covered.	3 / 3
Distinctiveness Conflict Risk	Quotes 'review the issue for security implications' and the specific trigger keywords, carving a clear niche (GitHub security-issue review) with distinct triggers unlikely to fire for unrelated skills, matching the score-3 anchor; it is not 2 because the scope is narrowly and unambiguously bounded.	3 / 3
	Total	11 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: NVIDIA/OpenShell
Path: .agents/skills/review-security-issue/SKILL.md
Commit: deced87

Reviewed: 6 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.