CtrlK
BlogDocsLog inGet started
Tessl Logo

review-security-issue

Given a GitHub issue, review the issue for security implications. You'll make a determination if the claim in the issue is legitimate and should be addressed or will be a "won't fix." Trigger keywords - security issue, review security ticket, review security issue.

59

Quality

70%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./.agents/skills/review-security-issue/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

75%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is a well-structured, actionable workflow with concrete gh CLI commands and clear step sequencing. It is lean and assumes competence, with only minor room to tighten prose and add an explicit validation/verification checkpoint after posting.

DimensionReasoningScore

Conciseness

The body is efficient, assumes Claude's competence (no explanations of GitHub or the gh CLI), and every code block earns its place; minor prose in the marker and prerequisites sections could be trimmed, keeping it at 4 rather than 5.

4 / 5

Actionability

It provides real, executable commands (`gh issue view`, `gh issue comment --body`, `gh issue edit --remove-label --add-label`) and a concrete Task tool invocation, with only the templated body placeholders representing minor gaps versus fully copy-paste-ready content.

4 / 5

Workflow Clarity

A clear six-step sequence with explicit decision branches and precondition validation in Step 2 (label checks, prior-review marker detection) provides most checkpoints; it lacks an explicit validate-fix-retry feedback loop, but the task is not a destructive or batch operation that requires one.

4 / 5

Progressive Disclosure

The single-file workflow is well organized with clear section headers (Prerequisites, Steps 1-6, Commands Reference, Example Usage) and needs no external references; at ~190 lines it is slightly long for one file, so it does not reach 5.

4 / 5

Total

16

/

20

Passed

Description

65%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description clearly conveys the skill's purpose and trigger conditions with good keyword coverage and distinctiveness. Its main weakness is the second-person voice ('You'll make a determination'), which the rubric penalizes, and the absence of broader trigger synonyms.

Suggestions

Rewrite in third person to avoid the voice penalty, e.g. 'Reviews a GitHub issue for security implications and determines whether the claim is legitimate and should be addressed or a won't fix.'

Expand trigger keywords with natural synonyms such as 'vulnerability', 'security bug', 'CVE', or 'security concern' for broader coverage.

Reframe the trigger list as an explicit 'Use when...' clause to lift completeness toward 5.

DimensionReasoningScore

Specificity

Names the security-issue domain and 1-2 concrete actions (review for security implications, determine legitimate vs won't-fix), matching anchor 3, but the second-person phrasing 'You'll make a determination' triggers the rubric's -1 voice penalty, dropping it to 2.

2 / 5

Completeness

It explicitly answers both 'what' (review issue for security implications, make a legitimate/won't-fix determination) and 'when' (trigger keywords), but the 'when' is a keyword list rather than a natural 'Use when...' clause, so it is not a 5.

4 / 5

Trigger Term Quality

Trigger keywords 'security issue, review security ticket, review security issue' are natural phrases a user would say, giving good coverage; it falls short of 5 because synonyms like 'vulnerability', 'CVE', or 'security bug/concern' are absent.

4 / 5

Distinctiveness Conflict Risk

The security-review niche with 'won't fix' determination and security trigger keywords is mostly distinct with minimal conflict risk; only minor overlap with a generic issue-review skill keeps it from 5.

4 / 5

Total

14

/

20

Passed

Validation

87%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation14 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

metadata_field

'metadata' should map string keys to string values

Warning

Total

14

/

16

Passed

Repository
NVIDIA/OpenShell
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.