Content
81%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A strong, highly actionable security-review skill with an explicit gated workflow, copy-paste-ready commands, clear checklists, and a decisive output format. Its main weaknesses are repetitive merge/close/supersede guidance stated nearly identically in three places, and inlined repo-specific reference material that would fit better in a separate file at this length.
Suggestions
Consolidate the merge/close/supersede guidance into one section (§6.5) and have the Overview and 'After The Review' sections reference it in one line each instead of restating the supersede mechanics ('offer to implement the narrow fix locally' currently appears in all three).
Move the OS-detection signal lists (§1.5) and the 'Electrobun Hotspots' list into a single references file (e.g. references/hotspots.md) and link to them from the body, reducing the SKILL.md to the workflow itself.
Merge the rundown requirements in §1 with the 'Output Format' section's structure so the expected first reply is specified in exactly one place.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is dense, rule-based, and assumes Claude's competence (no explanations of basic git/security concepts), but the merge/close/supersede guidance is repeated three times with overlapping wording — 'offer to implement the narrow fix locally' (Overview), 'offer to implement the narrow fix locally' / 'implement only the minimal repo-appropriate change' (§6.5), and 'prefer a narrow local fix over extended back-and-forth' (After The Review) — and the rundown requirements appear in both §1 and the Output Format section. This is more than minor trimming; it fits 'mostly efficient but could be tightened' rather than the level-4 'minor instances' anchor. | 3 / 5 |
Actionability | Guidance is copy-paste ready throughout: 'git fetch origin pull/<pr-number>/head:pr-<pr-number>' plus three concrete diff/log commands, 'run `bun build:dev` from `package/`' and 'run `bun dev` from `package/`' for builds, exact verdict vocabulary ('Safe to run as-is', 'Merge', 'Close', 'Supersede with direct fix'), and specific file-pattern lists for OS inference ('package/src/native/win/*', 'WebView2', 'D3D11'...). This matches the 'fully executable, covers common cases' anchor; it is not level 4 because there are no missing key details for the skill's core actions. | 5 / 5 |
Workflow Clarity | A clearly numbered sequence (0 through 6.5) with explicit gating checkpoints: 'If no PR URL has been pasted... ask for it and stop there', 'Do not run the PR branch, install dependencies, or execute tests until the diff passes a basic security screen', 'Only do this after the PR URL has been read', and validation/feedback loops like 'Re-diff or re-test the touched area before recommending merge' and 'If verification depends on one of those paths, stop and ask the user'. Checklists (risky-file priorities, threat-model questions) are present; not a destructive/batch skill, so no cap applies. Not level 4 because validation checkpoints are explicit rather than implicit. | 5 / 5 |
Progressive Disclosure | No bundle files exist, and the single SKILL.md is well-organized with clear section headers (Workflow, Electrobun Hotspots, Output Format, After The Review) and no nested references, so navigation is easy. It is not level 5 because at ~210 lines some repo-specific material (the OS-signal tables in §1.5 and the Electrobun Hotspots list) is inlined and could be split into a reference file, and the level-5 simple-skill exception (<50 lines) does not apply. It is clearly above level 3 because nothing that obviously belongs in a separate file is buried and all sections are clearly signaled. | 4 / 5 |
Total | 17 / 20 Passed |