ciso-review

/cs:ciso-review <plan> — Risk-paranoid interrogation of any plan that touches data, compliance, or production access. Use when launching features that handle customer data, before a SOC 2 / ISO audit, or after any incident or near-miss.

Quality

77%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

—

The risk profile of this skill

Fix and improve this skill with Tessl

tessl review fix ./c-level-agents/skills/ciso-review/SKILL.md

Quality

Content

76%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is concise, actionable, and well-structured, leaning on Claude's existing knowledge of security frameworks. Its main weakness is the disconnected, unvalidated Workflow section that doesn't integrate the two scripts into the question sequence.

Suggestions

Integrate the two scripts into an explicit numbered workflow with validation checkpoints (e.g., run risk_quantifier.py before the Blast Radius question, compliance_tracker.py before the Regulatory question) instead of listing them as bare commands.

Add an explicit validation/feedback step before the final Verdict (e.g., 'If any question is ❌ or unknown, route to /cs:decide before shipping') to give the sequence a real checkpoint.

Verify or make robust the external script and reference paths (../../../c-level-advisor/...); if they may not exist in the deployment, note that or inline minimal fallbacks.

Dimension	Reasoning	Score
Conciseness	Lean throughout; assumes Claude knows STRIDE, FAIR/ALE, and GDPR/HIPAA windows (stated as "GDPR: 72h. HIPAA: 60d.") with no concept padding, and every section earns its place.	5 / 5
Actionability	Provides concrete six-question prompts with sub-bullets, a copy-paste output template, and two executable commands; minor gaps are the brittle external script paths and the absence of a filled-in output example.	4 / 5
Workflow Clarity	The six questions form an implicit numbered sequence ending in a verdict checkpoint, but the "Workflow" section is just two bare commands with no sequencing or validation tying them to the questions, leaving checkpoints implicit.	3 / 5
Progressive Disclosure	Well-organized into clear sections with one-level-deep references clearly signaled under Workflow and Related; no bundle files exist, and the only gap is the brittleness of external relative paths that may not resolve.	4 / 5
	Total	16 / 20 Passed

Description

78%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description cleanly answers both what and when with concrete, third-person triggers and a well-scoped niche. It could list more concrete actions and a few more trigger synonyms to reach the top of the scale.

Dimension	Reasoning	Score
Specificity	Names the domain and one concrete action ("interrogation of any plan") with explicit scope (data, compliance, production access), but does not enumerate multiple distinct actions, so it is not comprehensive.	3 / 5
Completeness	Explicitly states what the skill does ("Risk-paranoid interrogation of any plan...") and gives concrete "Use when..." triggers (launching features with customer data, before an audit, after an incident).	5 / 5
Trigger Term Quality	Includes natural phrases a user would say ("customer data", "SOC 2 / ISO audit", "incident or near-miss"), but lacks common synonyms such as "breach", "security review", or "pen test".	4 / 5
Distinctiveness Conflict Risk	Has a clear CISO-review niche with distinct audit/incident triggers, but the body references a closely related sibling skill (ciso-advisor), creating minor overlap risk.	4 / 5
	Total	16 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
relative_links	Relative link issues: 2 suspicious	Warning

	Total	15 / 16 Passed

Repository: alirezarezvani/claude-skills
Path: c-level-agents/skills/ciso-review/SKILL.md
Commit: 19392f7

Reviewed: ~11 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.