cpg-analysis

Deep code property graph analysis with Joern CPG (AST+CFG+PDG) and CodeQL for control flow, data flow, taint analysis, and security auditing

Quality

—

Does it follow best practices?

Impact

—

No eval scenarios have been run

Securityby

Passed

No known issues

Quality

Content

65%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with executable queries and clear tool guidance, and is well structured. Its weaker spots are mild verbosity from explanatory columns, validation steps kept in anti-patterns rather than the workflow, and a monolithic file that could offload query/config detail to references.

Suggestions

Move the validation checkpoints (verify get_cpg_status, scope with Tier 1 first) inline into the Combined Workflow steps so they are part of the sequence, not just anti-patterns.

Offload the CPGQL and CodeQL query libraries plus MCP config snippets into reference files (e.g., references/cpgql-queries.md) and link to them from the overview to slim the main SKILL.md.

Trim the 'Tier 1 Can't Do This' explanatory columns and the AST/CFG/CDG/DDG glossary, which restate knowledge Claude already has.

Dimension	Reasoning	Score
Conciseness	Mostly efficient with tables, compact diagrams, and ready-to-run queries, but the CPG glossary diagram and 'Tier 1 Can't Do This' explanatory columns restate concepts Claude largely already knows and could be trimmed.	2 / 3
Actionability	Provides concrete, copy-paste-ready CPGQL and CodeQL queries, MCP config JSON, install commands, and tool tables with example queries — fully executable guidance rather than abstract description.	3 / 3
Workflow Clarity	The Combined Workflow gives a clear 5-step SCOPE→REPORT sequence, but validation checkpoints (get_cpg_status before querying, Tier-1 scoping first) live only in the Anti-Patterns table, not inline in the workflow steps themselves.	2 / 3
Progressive Disclosure	A single ~220-line file with no bundle references; sections are well organized, but query libraries and MCP configs that could be split into reference files are inlined, leaving the overview heavier than ideal.	2 / 3
	Total	9 / 12 Passed

Description

67%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and distinctive, naming concrete analysis capabilities and tools. Its main weakness is the absence of an explicit 'Use when...' trigger inside the description field and over-reliance on technical jargon over natural user phrasings.

Suggestions

Add an explicit 'Use when...' clause to the description itself (e.g., 'Use when doing a security audit, tracing data flow across functions, or hunting taint-style vulnerabilities').

Soften tool jargon with natural user terms — include phrases like 'security audit', 'find vulnerabilities', 'trace where user input flows' alongside Joern/CodeQL/CPG.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete capabilities — 'control flow, data flow, taint analysis, and security auditing' plus 'Joern CPG (AST+CFG+PDG) and CodeQL' — matching the anchor for several specific concrete actions.	3 / 3
Completeness	Clearly states what the skill does, but the description field itself lacks a 'Use when...' clause or equivalent explicit trigger; when-guidance lives only in the separate when-to-use field, which caps completeness at 2.	2 / 3
Trigger Term Quality	Includes some natural user terms ('security auditing', 'data flow', 'taint analysis') but leans heavily on tool/jargon names ('code property graph', 'AST+CFG+PDG', 'Joern', 'CodeQL') and omits common phrasings a user would actually say.	2 / 3
Distinctiveness Conflict Risk	Targets a clear niche (deep CPG/taint security analysis with named tools Joern and CodeQL) with distinct triggers, unlikely to conflict with general code-navigation skills.	3 / 3
	Total	10 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: alinaqi/claude-bootstrap
Commit: 9dacc46

Reviewed: about 8 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.