Content
42%Scale 1-3Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
This skill is a comprehensive security reference but suffers from being excessively verbose and monolithic—it explains many concepts Claude already knows well (SQL injection, XSS basics, environment variables) with full code examples that inflate the token cost significantly. The actionability is strong with executable, real-world code examples, but the lack of progressive disclosure and the flat checklist structure (rather than a prioritized workflow) reduce its effectiveness as a skill file.
Suggestions
Reduce content by 60-70%: remove explanations of well-known security concepts (SQL injection, XSS, CSRF) and keep only project-specific patterns, non-obvious gotchas, and the checklists. Claude already knows standard security practices.
Split into a concise SKILL.md overview with checklists only, and move detailed code examples into separate bundle files (e.g., examples/auth-patterns.md, examples/input-validation.md) referenced from the main file.
Add a sequenced workflow for conducting a security review: e.g., 1) scan for hardcoded secrets, 2) check input validation, 3) verify auth/authz, with explicit 'stop and fix' checkpoints before proceeding.
Remove the Solana/blockchain section unless this is specifically a blockchain project—it adds significant length for a niche use case that could be a separate skill.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The skill is extremely verbose at ~400+ lines, covering 10 security categories with extensive code examples for well-known patterns (SQL injection, XSS, CSRF, input validation) that Claude already understands deeply. Much of this is standard security knowledge that doesn't need to be spelled out in such detail—e.g., explaining what SQL injection is, showing basic parameterized queries, or demonstrating environment variable usage. | 1 / 3 |
Actionability | Every section provides concrete, executable TypeScript/SQL/bash code examples with clear FAIL/PASS patterns. The code is copy-paste ready with real libraries (zod, DOMPurify, express-rate-limit) and includes complete validation schemas, test examples, and deployment checklists. | 3 / 3 |
Workflow Clarity | The checklist structure is clear and each section has verification steps, but there's no sequenced workflow for how to conduct a security review—it's a flat list of categories without prioritization or a clear process for when/how to apply each check. The deployment checklist at the end helps but lacks feedback loops (e.g., what to do when a check fails). | 2 / 3 |
Progressive Disclosure | This is a monolithic wall of text with all 10 security categories fully expanded inline. There are no bundle files, yet the content would greatly benefit from splitting detailed code examples into separate reference files (e.g., auth-patterns.md, input-validation.md) with the SKILL.md serving as a concise overview pointing to them. The external resource links at the bottom don't compensate for the lack of internal structure. | 1 / 3 |
Total | 7 / 12 Passed |