security-review

Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.

Quality

66%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Medium

Suggest reviewing before use

Fix and improve this skill with Tessl

tessl review fix ./.kiro/skills/security-review/SKILL.md

Quality

Content

57%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a thorough, actionable security catalog with concrete code for each area and verification checklists throughout. Its weaknesses are verbosity from duplicated checklists, the absence of a sequenced review workflow with validation feedback loops, and no progressive disclosure despite length that would benefit from split reference files.

Suggestions

Consolidate the per-section 'Verification Steps' checklists into the single 'Pre-Deployment Security Checklist' to remove redundancy and trim tokens.

Add a short sequenced 'Review workflow' (e.g., identify surface area -> run through checklist -> verify with the automated tests -> re-check failing areas) with explicit validation checkpoints.

Move domain-specific deep dives (e.g., 'Blockchain Security (Solana)', 'Row Level Security') into reference files under references/ and link to them from SKILL.md to apply progressive disclosure.

Dimension	Reasoning	Score
Conciseness	Mostly efficient code examples, but padded with redundant per-section 'Verification Steps' checklists that repeat the closing 'Pre-Deployment Security Checklist', plus editorializing like 'Security is not optional. One vulnerability can compromise the entire platform.'	3 / 5
Actionability	Provides mostly executable, copy-paste-ready code (zod schemas, parameterized Supabase queries, DOMPurify, express-rate-limit), with minor gaps such as the abstract '@/lib/csrf' import.	4 / 5
Workflow Clarity	Organized as a catalog of security areas with per-section checklists, but lacks an overall review sequence with explicit validation checkpoints or feedback loops; it is a reference rather than a sequenced workflow.	3 / 5
Progressive Disclosure	Well-organized section headers, but it is a ~340-line monolithic file with no bundle references; per-area detail (e.g., blockchain, CSRF) that could live in separate reference files is inlined.	3 / 5
	Total	13 / 20 Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description clearly answers both what the skill does and when to use it, with concrete trigger conditions a user would naturally voice. Its main weakness is a slightly generic capability statement ('checklist and patterns') rather than naming the concrete security activities covered.

Dimension	Reasoning	Score
Specificity	Lists several concrete trigger actions ('adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features'), but the stated capability ('Provides comprehensive security checklist and patterns') is somewhat generic, leaving minor coverage gaps.	4 / 5
Completeness	Both 'what' ('Provides comprehensive security checklist and patterns') and 'when' ('Use this skill when adding authentication...') are explicit with concrete trigger phrases, but the 'what' could be more specific than 'checklist and patterns'.	4 / 5
Trigger Term Quality	Natural phrases users would say are present ('adding authentication', 'handling user input', 'working with secrets', 'creating API endpoints', 'payment/sensitive features'), with only a few common synonyms missing.	4 / 5
Distinctiveness Conflict Risk	The security niche with distinct triggers (auth, secrets, payments, API endpoints) is mostly distinguishable, with only minor overlap risk against generic code-review skills.	4 / 5
	Total	16 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: affaan-m/ECC
Path: .kiro/skills/security-review/SKILL.md
Commit: d8409a4

Reviewed: 1 day ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.