security-patterns

Security patterns and OWASP guidelines. Triggers on: security review, OWASP, XSS, SQL injection, CSRF, authentication, authorization, secrets management, input validation, secure coding.

1.03x

Quality

67%

Does it follow best practices?

Impact

95%

1.03x

Average score across 3 eval scenarios

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./data/skills-md/0xdarkmatter/claude-mods/security-patterns/SKILL.md

Quality

Content

65%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is an efficient, actionable reference with strong code examples and audit commands, but it has no real sequenced workflow with validation and ships broken references to non-existent bundle files.

Suggestions

Add the referenced files under ./references/ and ./scripts/ (or remove the dead links) so the signaled navigation actually resolves.

Provide a short sequenced 'Security review process' with explicit validation checkpoints (scan -> triage -> confirm -> fix -> re-scan) to support workflow clarity.

Trim reference content Claude already knows (the full OWASP Top 10 table, the 'never trust' enumeration) in favor of pointing to the detailed reference file.

Dimension	Reasoning	Score
Conciseness	The body is code- and table-centric with almost no prose padding and assumes Claude's competence, though reference content Claude largely already knows (the OWASP Top 10 list, 'never trust' list) is restated inline.	4 / 5
Actionability	It provides concrete, mostly copy-paste-ready code in Python/JS/bash and executable ripgrep audit commands, with only minor illustrative gaps (e.g., an undefined `db` object in the injection example).	4 / 5
Workflow Clarity	The content is a topic-organized reference catalog rather than a sequenced process; the 'Quick Security Audit' commands are loosely ordered but lack validation checkpoints, so workflow clarity is capped at 3.	3 / 5
Progressive Disclosure	SKILL.md is well-sectioned and signals one-level-deep references ('Additional Resources', 'Scripts'), but every referenced file (owasp-detailed.md, auth-patterns.md, crypto-patterns.md, secure-headers.md, security-scan.sh, dependency-audit.sh) is missing from the bundle, so navigation leads to dead ends.	3 / 5
	Total	14 / 20 Passed

Description

70%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is well-structured with an explicit trigger clause and good keyword coverage, though the 'what' leans on topics rather than concrete actions. It is clearly distinguishable and unlikely to fire for unrelated skills.

Suggestions

Lead with concrete action verbs (e.g., 'Reviews code for security flaws, applies OWASP mitigations') before listing trigger topics to lift specificity.

Add a couple of natural synonyms such as 'pentest', 'vulnerability scanning', or 'CVE' to round out trigger term coverage.

Dimension	Reasoning	Score
Specificity	The description names the domain ('Security patterns and OWASP guidelines') and several concrete topics (XSS, SQL injection, CSRF), but lists topics rather than concrete action verbs, leaving actions minimal-to-implied.	3 / 5
Completeness	It states a clear 'what' (security patterns and OWASP guidelines) and an explicit 'when' via the 'Triggers on:' clause with concrete trigger phrases; the 'what' is slightly generic, keeping it just below a 5.	4 / 5
Trigger Term Quality	'Triggers on: security review, OWASP, XSS, SQL injection, CSRF, authentication, authorization, secrets management, input validation, secure coding' covers many natural terms users would say, though it omits common synonyms like 'pentest', 'vulnerability', or 'CVE'.	4 / 5
Distinctiveness Conflict Risk	The specific security triggers (OWASP, XSS, CSRF, SQL injection) carve a fairly distinct niche with minimal overlap risk, though it could still overlap a little with a general code-review skill.	4 / 5
	Total	15 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: NeverSight/skills_feed
Path: data/skills-md/0xdarkmatter/claude-mods/security-patterns/SKILL.md
Commit: 2f57aec

Reviewed: about 21 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.