Content
73%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The body is a strong, dense analysis methodology: concrete detection patterns, a four-phase workflow with explicit validation, a feedback loop, and a closing checklist, plus a sensible severity rubric. Its two real defects are structural: all 16+ referenced bundle files listed in the References section are absent from the skill directory (breaking progressive disclosure entirely), and a malformed duplicate frontmatter block with a truncated description sits at the top of the body.
Suggestions
Ship the referenced files or fix the references: references/crypto-apis.md, config-patterns.md, auth-patterns.md, case-studies.md, the eleven lang-*.md guides, and language-specific.md are all listed but none exist in the bundle — every pointer currently dead-ends.
Standardize reference paths — one in-body pointer reads "See config-patterns.md" without the references/ prefix used everywhere else.
Remove the stray duplicate frontmatter block (lines 8–11) from the top of the body; it is truncated mid-sentence and renders as noise.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is dense and pattern-driven — a "Rationalizations to Reject" table, bulleted "Detection patterns:" lists, and short illustrative snippets — with almost no tutorial-style padding. It is not a 5 because of minor waste: the stray duplicate frontmatter block at the top of the body, and snippets that re-explain concepts Claude already knows (JWT `alg: "none"`, timing-unsafe `==` comparison). It is above 3 because there are no padded sections or unnecessary conceptual explanations. | 4 / 5 |
Actionability | Concrete, usable guidance throughout: specific detection patterns ("Function parameters like `algorithm`, `mode`, `cipher`, `hash_type`"), explicit probing questions ("What happens with `timeout=0`? `max_attempts=0`? `key=\"\"`?"), three well-defined adversary personas (The Scoundrel, The Lazy Developer, The Confused Developer), and per-finding validation steps ("Reproduce the misuse: Write minimal code demonstrating the footgun"). Not a 5 because the code examples are signature-level illustrative fragments rather than complete executable programs, and there is no runnable tooling; this is acceptable for an analysis skill but leaves minor gaps. | 4 / 5 |
Workflow Clarity | The Analysis Workflow is a clearly sequenced four-phase process (Surface Identification → Edge Case Probing → Threat Modeling → Validate Findings) where Phase 4 is explicit validation (reproduce the misuse, verify exploitability, check documentation, test mitigations). It includes a feedback loop ("If a finding seems questionable, return to Phase 2 and probe more edge cases") and a closing "Quality Checklist" — matching the anchor "Clear sequence with explicit validation steps; feedback loops for error recovery; checklists for complex processes". This is a read-only analysis skill, so the destructive/batch validation cap does not apply. | 5 / 5 |
Progressive Disclosure | The body is well-sectioned and the reference index is cleanly organized by category and language, but scored against the actual bundle structure it fails: every one of the 16+ referenced files (references/crypto-apis.md, references/config-patterns.md, references/auth-patterns.md, references/case-studies.md, eleven references/lang-*.md, references/language-specific.md) is missing — no references/ directory exists at all, so following any pointer fails. One in-body pointer even drops the path ("See config-patterns.md"). Not a 1 because the SKILL.md itself is well structured rather than a monolithic wall or nested reference chain, but the promised disclosure layer simply does not exist. | 2 / 5 |
Total | 15 / 20 Passed |