security-review

Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.

Quality

68%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./.agents/skills/security-review/SKILL.md

Quality

Content

71%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable with concrete, executable code and strong per-section verification, but it is a monolithic ~490-line file with no progressive disclosure or external references. Splitting large sections into reference files and tightening verbose explanations would improve conciseness and structure.

Suggestions

Move the large per-domain code examples and verification lists into reference files (e.g., references/secrets.md, references/auth.md) and keep SKILL.md as a concise overview with one-level-deep links.

Tighten repeated prose around code blocks (e.g., "ALWAYS do this" / "NEVER do this" commentary) and consolidate the duplicated pre-deployment checklist items that already appear as per-section verification steps.

Add an explicit numbered review workflow (e.g., 1. identify feature scope, 2. run relevant checklist sections, 3. verify, 4. re-review) so the multi-step process is sequenced rather than only implied.

Dimension	Reasoning	Score
Conciseness	The body is mostly efficient with concrete code per section, but the ~490-line monolith inlines extensive examples and repeated verification checkboxes that could be tightened; it is somewhat verbose rather than lean.	3 / 5
Actionability	It provides fully executable TypeScript, SQL, and bash snippets with explicit FAIL/PASS contrasts (e.g., parameterized queries, httpOnly cookies, DOMPurify) that are copy-paste ready and cover the common security cases.	5 / 5
Workflow Clarity	Per-section "Verification Steps" and a consolidated pre-deployment checklist provide clear validation checkpoints, but there is no explicit numbered review workflow with feedback loops, leaving minor sequencing gaps.	4 / 5
Progressive Disclosure	No bundle files exist and all content is inlined into one long SKILL.md; section headers give some structure, but bulk reference-style content that could be split into separate files remains inline.	3 / 5
	Total	15 / 20 Passed

Description

65%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description has strong, explicit trigger guidance and decent distinctiveness, but its "what" statement is generic ("comprehensive security checklist and patterns") rather than naming concrete actions. Tightening the capability statement with specific actions would lift specificity and completeness.

Suggestions

Replace the generic "Provides comprehensive security checklist and patterns" with concrete actions such as "audits code for vulnerabilities, validates secrets handling, reviews input validation and auth patterns".

Add common synonyms/file-extension-style triggers (e.g., "auth", "API keys", "OWASP", "pentest review") to broaden natural keyword coverage.

Dimension	Reasoning	Score
Specificity	The only named action is "Provides comprehensive security checklist and patterns", which is generic; the rest of the description enumerates domains (authentication, input, secrets, endpoints, payments) rather than concrete actions, matching the anchor that names the domain but offers minimal/generic actions.	2 / 5
Completeness	It has both a "what" ("Provides comprehensive security checklist and patterns") and an explicit "when" ("Use this skill when..."), but the "what" is generic rather than concrete, so it stops short of the level-5 anchor.	4 / 5
Trigger Term Quality	Phrases like "adding authentication", "handling user input", "working with secrets", "creating API endpoints", and "payment/sensitive features" are natural things a user would say, giving good keyword coverage, though some synonyms or common variations are missing.	4 / 5
Distinctiveness Conflict Risk	The security niche is mostly distinct, but broad triggers like "handling user input" and "creating API endpoints" overlap with general coding skills, creating minor conflict risk with closely related skills.	4 / 5
	Total	14 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: affaan-m/ECC
Path: .agents/skills/security-review/SKILL.md
Commit: d8409a4

Reviewed: 1 day ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.