security-review

在添加身份验证、处理用户输入、处理机密信息、创建API端点或实现支付/敏感功能时使用此技能。提供全面的安全检查清单和模式。

Quality

66%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./docs/zh-CN/skills/security-review/SKILL.md

Quality

Content

60%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A genuinely actionable security checklist with strong executable examples and clear verification checkpoints, but it is bloated and monolithic — heavy redundancy between per-category checklists and the final checklist, with no use of reference files to defer detail.

Suggestions

Split each security category into separate reference files (e.g. references/secrets.md, references/input-validation.md) and keep SKILL.md as a short overview with clearly signaled one-level-deep links to lift progressive_disclosure.

Remove the per-category '验证步骤' checkbox lists or fold them into a single consolidated checklist to eliminate the duplication that drives the conciseness penalty.

Tighten prose by dropping explanatory padding Claude already knows (e.g. restating that parameterized queries prevent injection) and lead each section directly with the FAIL/PASS code pair.

Dimension	Reasoning	Score
Conciseness	The ~500-line body repeats material — each category has its own '验证步骤' checkboxes that restate the consolidated pre-deployment checklist, and the full reference material is inlined rather than split out.	2 / 5
Actionability	Concrete, executable code blocks (zod schemas, parameterized queries, httpOnly cookie set-up, RLS SQL, express-rate-limit) are copy-paste ready and cover the common security cases.	5 / 5
Workflow Clarity	Each topic carries explicit verification checkboxes and a consolidated pre-deployment checklist acts as a validation gate; minor gaps in sequencing a single end-to-end review workflow.	4 / 5
Progressive Disclosure	No bundle files exist and everything is inlined into one monolithic SKILL.md; per-category deep-dive content that belongs in separate reference files is buried inline with no file-level navigation.	2 / 5
	Total	13 / 20 Passed

Description

73%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A well-constructed description with an explicit trigger clause and a concrete deliverable; it clearly distinguishes the skill's niche. It could name a few more specific concrete actions to lift specificity.

Dimension	Reasoning	Score
Specificity	States it 'provides a comprehensive security checklist and patterns' — names the domain and a concrete deliverable, but lists no specific concrete actions beyond that single phrase.	3 / 5
Completeness	Explicitly answers both 'what' (provides security checklists and patterns) and 'when' ('use this skill when...'), with the 'what' reasonably concrete though not maximally specific.	4 / 5
Trigger Term Quality	Natural trigger scenarios ('adding authentication, handling user input, handling secrets, creating API endpoints, implementing payments') align well with what users would say; a few synonyms are missing.	4 / 5
Distinctiveness Conflict Risk	A clearly bounded security-review niche with distinct triggers; minimal risk of firing for unrelated skills.	5 / 5
	Total	16 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (528 lines); consider splitting into references/ and linking	Warning
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	14 / 16 Passed

Repository: affaan-m/ECC
Path: docs/zh-CN/skills/security-review/SKILL.md
Commit: e04ea0b

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.