CtrlK
BlogDocsLog inGet started
Tessl Logo

security-review

Deprecated standalone security review skill

56

Quality

64%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/security-review/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

92%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is an exemplary lean deprecation notice: terse, unambiguous, and actionable, pointing directly to the replacement skill. Its only minor gap is that it offers a single redirect rather than covering edge cases.

DimensionReasoningScore

Conciseness

The body is three lean lines with no concept padding and no over-explanation, assuming Claude's competence; every line earns its place (deprecation directive, redirect target, arguments placeholder). This matches the lean-and-efficient anchor.

5 / 5

Actionability

"Use `$code-review` directly for new review workflows when security concerns are in scope" is a concrete, executable directive naming the exact replacement skill. It is below anchor 5 only because it provides a single redirect rather than examples covering common cases.

4 / 5

Workflow Clarity

This is a single-purpose deprecated skill whose single action is unambiguous: do not invoke it, use $code-review when security is in scope. Per the simple-skill exception, a single clear action scores 5, and no destructive/batch validation is required.

5 / 5

Progressive Disclosure

The skill is well under 50 lines with a clear heading and no need for external references (none exist in the bundle). Per the rubric guideline, such a simple, well-organized skill scores 5 with just organized sections.

5 / 5

Total

19

/

20

Passed

Description

36%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is a deprecation label rather than a capability statement: it names a domain but states no concrete actions and no usage triggers. It is just specific enough to avoid the lowest scores, but its incompleteness and overlap with code-review skills keep it weak.

Suggestions

Even for a deprecated skill, restate what it did in concrete terms (e.g. "Reviewed diffs for vulnerabilities and insecure patterns") so the deprecation is self-explanatory.

Add an explicit redirect trigger, e.g. "Use $code-review when security concerns are in scope," to carry the when-to-use guidance into the description.

Disambiguate from generic review skills by naming the distinct niche (e.g. "standalone security/vulnerability review") to reduce conflict risk.

DimensionReasoningScore

Specificity

"Deprecated standalone security review skill" names the domain (security review) but provides zero concrete actions, matching the anchor that names a domain with only minimal/generic actions. It is above a purely vague anchor because the domain is specific, but below anchor 3 which requires 1-2 concrete actions.

2 / 5

Completeness

It gives only a vague label of "what" ("security review skill") and provides no "when to use it" guidance — there is no "Use when..." clause, capping completeness per the rubric guideline. It is above anchor 1 only because a vague what is present.

2 / 5

Trigger Term Quality

"security review" is a relevant natural term a user would say, but the description offers only that single phrase and misses common variations or synonyms (e.g. security audit, vulnerability review). It is above anchor 2 because the term is natural rather than generic, but below anchor 4 due to thin coverage.

3 / 5

Distinctiveness Conflict Risk

"security review" is a somewhat specific niche, but the skill clearly overlaps with general review/code-review skills (the body itself redirects to $code-review). It fits the anchor for somewhat specific but with overlap risk, rather than the mostly-distinct anchor 4.

3 / 5

Total

10

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
Yeachan-Heo/oh-my-codex
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.