Content
81%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The body is a well-structured, actionable methodology with a standout iterative workflow that includes real validation and feedback loops. It is held back from the top tier by minor verbosity, a placeholder search example, and progressive-disclosure references that point to files not actually bundled here.
Suggestions
Replace the placeholder `rg -n "exact_vulnerable_code_here"` with a realistic worked example (or inline one of the referenced Semgrep/CodeQL query templates) so the core instruction is copy-paste executable without leaving SKILL.md.
Tighten the 'Critical Pitfalls' section by collapsing the repeated Example+Mitigation structure into a single line each, or move it into METHODOLOGY.md to keep SKILL.md as a lean overview.
Add 'static analysis' / 'SAST' to the description trigger terms and confirm the referenced METHODOLOGY.md and resources/ files are bundled so the progressive-disclosure navigation is resolvable.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is efficient and assumes Claude's competence (it never explains what CodeQL, Semgrep, or a vulnerability is), using tables to compress information; minor over-explanation remains in the tool-selection 'Why' column and the repetitive Example/Mitigation phrasing of the pitfalls section, keeping it just below anchor 5. | 4 / 5 |
Actionability | Provides a concrete five-step process, an abstraction-points table, a tool-selection table, and an executable `rg -n` command, but the ripgrep example is a placeholder and the real CodeQL/Semgrep query templates are deferred to un-bundled `resources/` files, leaving minor gaps versus fully copy-paste-ready anchor 5. | 4 / 5 |
Workflow Clarity | The five-step process is clearly sequenced with an explicit validation checkpoint ('Verify: Does it match exactly ONE location?') and a genuine feedback loop in Step 4 (run, review all matches, classify TP/FP, revert if FP rate too high, stop at ~50%), plus a triage checklist in Step 5, matching anchor 5; the operation is read-only so the destructive-cap does not apply. | 5 / 5 |
Progressive Disclosure | Well-organized into clear sections with one-level-deep, clearly signaled references ('see METHODOLOGY.md', 'Ready-to-use templates in resources/'), but no bundle files are present to verify those references against and a fair amount of inline content (Critical Pitfalls, Key Principles) could arguably live in METHODOLOGY.md, so it sits below the clean split of anchor 5. | 4 / 5 |
Total | 17 / 20 Passed |