CtrlK
BlogDocsLog inGet started
Tessl Logo

security-review

在添加身份验证、处理用户输入、处理机密信息、创建API端点或实现支付/敏感功能时使用此技能。提供全面的安全检查清单和模式。

49

Quality

54%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./docs/zh-CN/skills/security-review/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

42%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

This skill is a comprehensive security reference but suffers from being excessively verbose and monolithic—it explains many concepts Claude already knows well (SQL injection, XSS basics, environment variables) with full code examples that inflate the token cost significantly. The actionability is strong with executable, real-world code examples, but the lack of progressive disclosure and the flat checklist structure (rather than a prioritized workflow) reduce its effectiveness as a skill file.

Suggestions

Reduce content by 60-70%: remove explanations of well-known security concepts (SQL injection, XSS, CSRF) and keep only project-specific patterns, non-obvious gotchas, and the checklists. Claude already knows standard security practices.

Split into a concise SKILL.md overview with checklists only, and move detailed code examples into separate bundle files (e.g., examples/auth-patterns.md, examples/input-validation.md) referenced from the main file.

Add a sequenced workflow for conducting a security review: e.g., 1) scan for hardcoded secrets, 2) check input validation, 3) verify auth/authz, with explicit 'stop and fix' checkpoints before proceeding.

Remove the Solana/blockchain section unless this is specifically a blockchain project—it adds significant length for a niche use case that could be a separate skill.

DimensionReasoningScore

Conciseness

The skill is extremely verbose at ~400+ lines, covering 10 security categories with extensive code examples for well-known patterns (SQL injection, XSS, CSRF, input validation) that Claude already understands deeply. Much of this is standard security knowledge that doesn't need to be spelled out in such detail—e.g., explaining what SQL injection is, showing basic parameterized queries, or demonstrating environment variable usage.

1 / 3

Actionability

Every section provides concrete, executable TypeScript/SQL/bash code examples with clear FAIL/PASS patterns. The code is copy-paste ready with real libraries (zod, DOMPurify, express-rate-limit) and includes complete validation schemas, test examples, and deployment checklists.

3 / 3

Workflow Clarity

The checklist structure is clear and each section has verification steps, but there's no sequenced workflow for how to conduct a security review—it's a flat list of categories without prioritization or a clear process for when/how to apply each check. The deployment checklist at the end helps but lacks feedback loops (e.g., what to do when a check fails).

2 / 3

Progressive Disclosure

This is a monolithic wall of text with all 10 security categories fully expanded inline. There are no bundle files, yet the content would greatly benefit from splitting detailed code examples into separate reference files (e.g., auth-patterns.md, input-validation.md) with the SKILL.md serving as a concise overview pointing to them. The external resource links at the bottom don't compensate for the lack of internal structure.

1 / 3

Total

7

/

12

Passed

Description

67%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description provides a reasonable overview of when to use the skill with explicit trigger conditions, which is its strongest aspect. However, it lacks specificity in the concrete actions it performs (what security patterns exactly?) and could benefit from more natural trigger terms covering common security-related vocabulary. The broad scope creates some risk of overlap with other development-focused skills.

Suggestions

Add more specific concrete actions, e.g., 'Validates input against injection attacks, implements CSRF protection, enforces secure password hashing, reviews code for OWASP Top 10 vulnerabilities'

Expand trigger terms to include common security-related keywords users would naturally use: 'security review,' 'vulnerability,' 'encryption,' 'authorization,' 'SQL injection,' 'XSS,' 'OWASP'

DimensionReasoningScore

Specificity

The description names several domains (authentication, user input handling, confidential information, API endpoints, payment/sensitive functionality) and mentions 'comprehensive security checklists and patterns,' but doesn't list specific concrete actions like 'validate input against XSS,' 'implement CSRF tokens,' etc.

2 / 3

Completeness

The description clearly answers both 'what' (provides comprehensive security checklists and patterns) and 'when' (when adding authentication, handling user input, processing confidential information, creating API endpoints, or implementing payment/sensitive functionality). The 'when' triggers are explicit and actionable.

3 / 3

Trigger Term Quality

Includes relevant keywords like '身份验证' (authentication), '用户输入' (user input), 'API端点' (API endpoints), '支付' (payment), '机密信息' (confidential information). These are reasonable trigger terms but miss common variations like 'security,' 'OWASP,' 'encryption,' 'authorization,' 'SQL injection,' 'XSS,' 'password hashing,' etc.

2 / 3

Distinctiveness Conflict Risk

The security focus is somewhat distinctive, but terms like 'API端点' and '用户输入' could overlap with general web development or API design skills. The scope is broad enough that it might conflict with more specialized authentication or payment processing skills.

2 / 3

Total

9

/

12

Passed

Validation

81%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation9 / 11 Passed

Validation for skill structure

CriteriaDescriptionResult

skill_md_line_count

SKILL.md is long (528 lines); consider splitting into references/ and linking

Warning

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

9

/

11

Passed

Repository
affaan-m/ECC
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.