security-review

Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.

Quality

63%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./docs/zh-TW/skills/security-review/SKILL.md

Quality

Content

57%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a thorough, highly actionable security reference with strong FAIL/PASS code examples and per-category verification checklists. Its main weaknesses are length/redundancy, lack of an explicit fix-and-revalidate workflow, and a monolithic single-file structure that should be split into references.

Suggestions

Move the detailed per-category code examples into reference files (e.g. references/auth.md, references/injection.md) and keep SKILL.md as an overview pointing to them, improving progressive disclosure and conciseness.

Add an explicit review workflow with a feedback loop, e.g. 'Run each category checklist → on any FAIL, fix and re-check that category → only proceed to deploy when all checks pass'.

Remove the duplicated deployment checklist and the '何時啟用' list (which repeats the frontmatter description) to tighten token usage.

Dimension	Reasoning	Score
Conciseness	Per-section content is mostly efficient code and checklists, but the file is very long with redundancy: the '何時啟用' list repeats the frontmatter triggers and the '部署前安全檢查清單' duplicates the per-section '驗證步驟' checklists.	3 / 5
Actionability	Abundant concrete FAIL/PASS TypeScript, SQL, and bash examples cover the common cases and are largely copy-paste ready, with minor gaps where examples depend on unspecified helpers like '@/lib/csrf', 'getBalance', or 'expectedRecipient'.	4 / 5
Workflow Clarity	Per-section '驗證步驟' checklists and a pre-deployment checklist provide checkpoints, but there is no explicit review-then-fix-then-revalidate workflow with feedback loops tying the categories into a sequenced process.	3 / 5
Progressive Disclosure	Section headers give reasonable structure, but with no bundle files the entire ~280-line reference (10 detailed categories of full code examples) is inlined in SKILL.md rather than split into one-level-deep reference files.	3 / 5
	Total	13 / 20 Passed

Description

70%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description clearly states when to use the skill with concrete, natural trigger phrases and identifies the domain well. It is slightly weaker on specifying concrete actions and has minor overlap risk from broad terms.

Suggestions

Replace the generic 'Provides comprehensive security checklist and patterns' with specific actions, e.g. 'Reviews code for injection, auth, and secret-handling vulnerabilities against a security checklist'.

Tighten 'payment/sensitive features' to more distinctive triggers like 'handling payments, PII, or credentials' to reduce overlap with general feature-development skills.

Dimension	Reasoning	Score
Specificity	It names the security domain and one concrete deliverable ('Provides comprehensive security checklist and patterns'), but the bulk of the sentence enumerates trigger domains rather than distinct concrete actions, so coverage of actions is not comprehensive.	3 / 5
Completeness	Both 'what' (provides security checklist and patterns) and 'when' (explicit 'Use this skill when...' with concrete triggers) are present; the 'what' is clear but slightly high-level, keeping it just below the top anchor.	4 / 5
Trigger Term Quality	Natural trigger phrases users would say ('adding authentication', 'handling user input', 'working with secrets', 'creating API endpoints', 'payment/sensitive features') give good keyword coverage, though a few synonyms are missing.	4 / 5
Distinctiveness Conflict Risk	Security review is a fairly distinct niche with specific triggers, though broad terms like 'sensitive features' and 'API endpoints' create minor overlap with general development skills.	4 / 5
	Total	15 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: affaan-m/ECC
Path: docs/zh-TW/skills/security-review/SKILL.md
Commit: e04ea0b

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.