secure-code-review

Use this skill when reviewing or writing code that handles user input, authentication, file I/O, network requests, or database queries. Always check for common security vulnerabilities before considering the code complete.

Quality

70%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./memory_data/skills/secure-code-review/SKILL.md

Quality

Content

72%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A lean, well-organized security checklist that respects the token budget and assumes Claude's competence. Its main weakness is actionability and workflow clarity: it states what to check but rarely how, and lacks an explicit verification gate to confirm all categories pass before declaring code complete.

Suggestions

Add small executable snippets for the non-obvious checks (e.g., a parameterized-query example and an HTML-escaping one-liner) to make guidance copy-paste ready.

Add an explicit final verification step (e.g., 'Run through every section above; only mark code complete once all items are confirmed') to give the checklist a clear validation gate.

Consider a one-line pointer to a reference file for deeper vulnerability patterns (e.g., OWASP) if the team wants room to grow without bloating the overview.

Dimension	Reasoning	Score
Conciseness	Tight bullet directives with no concept-explaining padding ('Never trust user-supplied input; validate type, length, and format at boundaries') — it assumes Claude knows what XSS/SQL injection are and every token earns its place, matching the 3 anchor. Not below because nothing is padded or over-explained.	3 / 3
Actionability	Provides concrete directives and some executable commands ('audit with `pip audit` or `npm audit`'), but offers no executable examples for the harder items like parameterized queries or HTML sanitization. 'Some concrete guidance but incomplete' fits the 2 anchor; not 3 because it is not copy-paste ready, and not 1 because it does give specific commands.	2 / 3
Workflow Clarity	Content is well-organized into categories (Input Validation, Secrets, Dependencies, Auth), but there is no sequenced walkthrough or explicit verification gate confirming all checks pass before marking code complete. 'Steps listed but validation gaps' fits the 2 anchor; not 3 because no explicit validation checkpoint is present.	2 / 3
Progressive Disclosure	The skill is under 50 lines, needs no external references, and is organized into clearly labeled sections — per the simple-skills note this earns a 3 with just well-organized sections. Not below because organization is clean and there is no nested-reference problem.	3 / 3
	Total	10 / 12 Passed

Description

67%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description has a strong explicit 'Use when' trigger and answers both what and when, but its action list is thin and its trigger terms miss common variations like 'security audit' and 'injection'. The broad 'reviewing or writing code' phrasing risks overlap with general code-review skills.

Suggestions

Expand the action list to concrete review behaviors (e.g., 'check for injection, broken access control, and sensitive-data exposure') to raise specificity.

Add common natural trigger terms users say ('security audit', 'penetration test', 'is this code secure', 'OWASP') to improve trigger-term coverage and distinctiveness.

Narrow the trigger to security-focused review (e.g., 'when the user asks for a security review or wants to harden code') to reduce overlap with general code-review skills.

Dimension	Reasoning	Score
Specificity	Quotes concrete risk domains ('user input, authentication, file I/O, network requests, or database queries') and one action ('check for common security vulnerabilities'), but does not enumerate multiple distinct review actions the way the 3-anchor does. It names domain and some actions, but is not comprehensive — matching the 2 anchor rather than the 3 anchor's 'multiple specific concrete actions'.	2 / 3
Completeness	Explicitly answers both 'what' ('check for common security vulnerabilities before considering the code complete') and 'when' ('Use this skill when reviewing or writing code that handles...') with an explicit trigger clause, matching the 3 anchor. Not below because both elements are clearly and explicitly present.	3 / 3
Trigger Term Quality	Includes relevant natural terms ('reviewing or writing code', 'security vulnerabilities') but misses common variations a user might say ('security audit', 'pentest', 'injection', 'XSS', 'secure coding'). Some relevant keywords but missing common variations fits the 2 anchor.	2 / 3
Distinctiveness Conflict Risk	The security focus gives it a niche, but the trigger 'reviewing or writing code' is broad and would overlap with a general code-review skill. Somewhat specific but could still overlap with similar skills fits the 2 anchor rather than the 3 anchor's 'clear niche with distinct triggers'.	2 / 3
	Total	9 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: aiming-lab/MetaClaw
Path: memory_data/skills/secure-code-review/SKILL.md
Commit: 922caf3

Reviewed: 9 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.