Content
96%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A dense, executable security playbook that respects the token budget and ships concrete commands plus a validation contract; its only weakness is that progressive disclosure relies on a single inlined file rather than split references.
Suggestions
Consider extracting the per-language sinks table or the CVSS matrix into a reference file and signaling it from SKILL.md to bring progressive_disclosure to a clean 5.
Keep the validation contract pattern (success/negative patterns) as a model for future audit skills — it is exactly the feedback loop the rubric rewards.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is lean and assumes Claude's competence — every section delivers actionable signal (sinks table, grep patterns, PoC curl) with only minimal editorial framing like 'Classic, still the king'; no padding explaining what SQL injection is. | 5 / 5 |
Actionability | Fully executable guidance: concrete `semgrep`/`grep -rE` commands with exact patterns, copy-paste curl PoCs, and a safe-vs-dangerous API table per language/framework — covers the common cases directly. | 5 / 5 |
Workflow Clarity | Clear sequenced hunt flow (Sources → Sinks → Audit steps → PoC → validate) with an explicit validate_finding contract including success_patterns, negative_command, and negative_patterns forming a real validation feedback loop. | 5 / 5 |
Progressive Disclosure | No bundle files exist, so structure is self-contained; sections are clearly headed and navigable with no nested references, but the ~110-line body is longer than the under-50-line simple-skill exception, so it is not a clean 5. | 4 / 5 |
Total | 19 / 20 Passed |