security-review

Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.

Quality

75%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./.agents/skills/security-review/SKILL.md

Quality

Content

62%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, code-rich security reference weakened by its monolithic, ~490-line structure and repeated checklists that hurt conciseness and progressive disclosure. It would benefit from splitting topics into reference files and collapsing redundant verification lists.

Suggestions

Split the per-section deep-dives (e.g. Auth, SQL Injection, Blockchain) into separate reference files in references/ and keep SKILL.md as an overview with one-level-deep links.

Collapse the redundant 'Pre-Deployment Security Checklist' into the per-section verification steps, or replace the per-section lists with it, to remove repetition and tighten conciseness.

Add an explicit ordered workflow with validation checkpoints (e.g. review → verify each section's checklist → only then deploy) to raise workflow clarity above a flat catalog.

Dimension	Reasoning	Score
Conciseness	The ~490-line body is mostly efficient and actionable but could be tightened: it repeats the same checks across per-section 'Verification Steps' and a largely redundant 'Pre-Deployment Security Checklist', and includes commentary ('Security is not optional') that pads rather than instructs.	2 / 3
Actionability	It provides fully executable, copy-paste-ready TypeScript/SQL/bash examples and concrete commands (npm audit, npm ci), matching the 'fully executable code/commands' anchor.	3 / 3
Workflow Clarity	Sections are organized and each has a verification checklist, but the body is a catalog of topics rather than a sequenced multi-step process with explicit validation checkpoints and fix→retry feedback loops, so it sits at the 'steps listed but validation gaps' level.	2 / 3
Progressive Disclosure	No bundle files (references/, scripts/, assets/) exist and all material is inline in one ~490-line file; content that should be separate (per-topic deep-dives) is inlined rather than split into one-level-deep references.	2 / 3
	Total	9 / 12 Passed

Description

87%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description with clear what/when structure and good natural trigger terms, slightly held back only by the second-person 'Use this skill' phrasing. It clearly communicates its niche and when to activate.

Dimension	Reasoning	Score
Specificity	It lists several concrete triggers ('adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features') and names a deliverable ('security checklist and patterns'), which would be a 3, but the second-person phrasing 'Use this skill when...' triggers the rubric's one-point specificity penalty.	2 / 3
Completeness	It explicitly answers both what ('Provides comprehensive security checklist and patterns') and when ('Use this skill when...') with explicit triggers, satisfying the top anchor.	3 / 3
Trigger Term Quality	Natural terms a user would actually say are well covered — 'authentication', 'user input', 'secrets', 'API endpoints', 'payment/sensitive features' — matching the good-coverage anchor.	3 / 3
Distinctiveness Conflict Risk	The security-review niche is clearly defined with distinct, specific triggers that are unlikely to fire for unrelated skills.	3 / 3
	Total	11 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: affaan-m/ECC
Path: .agents/skills/security-review/SKILL.md
Commit: 0c1d7be

Reviewed: 6 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.