Content
78%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A tight, well-sequenced security-audit checklist with concrete per-step checks and no concept padding. Its main weakness is that it defers the detailed procedure and finding template to bundle files that are not present, leaving the references dangling.
Suggestions
Ship the referenced bundle files `plays/mcp-server-review.md` and `templates/finding.md`, or inline the full procedure so the skill is self-contained.
Add a validation/triage step (e.g., confirm each finding is reproducible and assign severity before writing it up) to give the workflow an explicit checkpoint.
Make the supply-chain step actionable by naming a concrete SCA command or tool instead of "run SCA on dependencies".
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | Lean checklist with no concept padding — it assumes Claude knows TLS, SSRF, and SCA, and every parenthetical ("stdio vs HTTP/SSE", "../ in file paths", "169.254.169.254") is a concrete example that earns its place. | 5 / 5 |
Actionability | Concrete, specific checks (command injection via shell interpolation, path traversal via ../, unparameterized SQL, SSRF) and a clear risk taxonomy (READ-ONLY/MUTATION/DESTRUCTIVE/NETWORK/CREDENTIAL-ACCESS), but "run SCA on dependencies" names no tool and the "full procedure" is deferred to a missing file. | 4 / 5 |
Workflow Clarity | Seven clearly sequenced, numbered steps each containing explicit sub-checks; minor gap is the absence of a finding-triage/validation checkpoint to confirm findings and calibrate severity before output. | 4 / 5 |
Progressive Disclosure | Sections are well-organized and references are inline-signaled, but both referenced paths (`plays/mcp-server-review.md`, `templates/finding.md`) do not exist as bundle files — the "full procedure" the body defers to is missing, breaking navigation. | 3 / 5 |
Total | 16 / 20 Passed |