security-review

Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.

Quality

68%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/security-review/SKILL.md

Quality

Content

63%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is a thorough, actionable security reference with concrete code and per-area verification checklists. Its weaknesses are length/duplication and a monolithic single-file structure with no progressive disclosure into reference files.

Suggestions

Move the detailed per-topic code examples (e.g., Solana wallet verification, rate-limiting config, RLS SQL) into reference files under references/ and link to them from a leaner SKILL.md overview.

De-duplicate the verification steps: keep either the per-section checklists or the master pre-deployment checklist, not both, to cut tokens.

Fix the Solana example (`@solana/web3.js` has no top-level `verify`; use `nacl.sign.detached.verify`) and align the rate-limiting example with Next.js middleware rather than Express to keep examples executable in the skill's stated stack.

Dimension	Reasoning	Score
Conciseness	The body is mostly actionable code and checklists with little concept over-explanation, but ~500 inlined lines plus duplicated verification steps (per-section lists and a master pre-deployment checklist) could be tightened.	3 / 5
Actionability	It provides extensive copy-paste-ready code (zod schemas, parameterized queries, httpOnly cookies, RLS policies, DOMPurify, rate limiting), but minor inaccuracies (the Solana `verify` import, mixing express-rate-limit into a Next.js context) keep it from a 5.	4 / 5
Workflow Clarity	A clear activate-then-review-areas-then-pre-deploy sequence exists with explicit verification checklists per section, but it is a reference checklist rather than an ordered process with validate-fix-retry feedback loops.	4 / 5
Progressive Disclosure	No bundle files exist and all ten detailed security topics with full code are inlined into a single ~500-line SKILL.md; section headers give structure, but content that would benefit from separate reference files is not split out.	3 / 5
	Total	14 / 20 Passed

Description

73%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description clearly answers both what the skill does and when to use it with strong trigger-term coverage and a distinct security niche. Its main weakness is a generic action statement ('provides comprehensive security checklist and patterns') combined with a second-person voice.

Suggestions

Replace the generic 'Provides comprehensive security checklist and patterns' with concrete actions the skill performs, e.g., 'Reviews code for hardcoded secrets, injection risks, and missing auth checks against a security checklist.'

Rephrase 'Use this skill when...' into third person to match the rubric's voice guidance, e.g., 'Use when adding authentication...' or 'Activates when the user adds authentication...'.

Add a few natural synonyms (login, credentials, tokens) to broaden trigger-term coverage toward a 5.

Dimension	Reasoning	Score
Specificity	The skill's actual action is stated only as 'Provides comprehensive security checklist and patterns,' which is generic, while the listed items (auth, input, secrets, endpoints, payments) are user trigger contexts rather than concrete skill actions; a second-person 'Use this skill when' voice further reduces the score by one per the rubric.	2 / 5
Completeness	It explicitly answers both 'what' ('Provides comprehensive security checklist and patterns') and 'when' with concrete trigger phrases ('Use this skill when adding authentication, handling user input...').	5 / 5
Trigger Term Quality	Natural developer-facing terms like 'authentication,' 'user input,' 'secrets,' 'API endpoints,' and 'payment/sensitive features' give good coverage, though common synonyms (login, credentials) are missing.	4 / 5
Distinctiveness Conflict Risk	Security review is a clear niche, but broad triggers like 'handling user input' and 'creating API endpoints' overlap with general coding skills, so minor conflict risk remains.	4 / 5
	Total	15 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (505 lines); consider splitting into references/ and linking	Warning
metadata_version	'metadata.version' is missing	Warning

	Total	14 / 16 Passed

Repository: affaan-m/ECC
Path: skills/security-review/SKILL.md
Commit: 06c5e11

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.