CtrlK
BlogDocsLog inGet started
Tessl Logo

security-review

How to review PRs for security — credentials, injection, workflow permissions, supply chain, git operation safety

61

Quality

72%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./.copilot/skills/security-review/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

77%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-structured security review skill with concrete patterns and a clear output workflow, but it is verbose in places and ships as a monolithic file with no progressive disclosure of reference material.

Suggestions

Tighten explanations of concepts Claude already knows (e.g. why exec is injection-prone, GitHub token event recursion) to bare reminders.

Split the extensive example findings and severity guide into a referenced reference file to reduce SKILL.md footprint and add one-level-deep progressive disclosure.

DimensionReasoningScore

Conciseness

Mostly efficient actionable checklists, but it includes explanatory context Claude already knows (e.g. 'exec uses a shell and is vulnerable to injection', 'GITHUB_TOKEN-generated events do NOT trigger new workflow runs') that could be tightened.

2 / 3

Actionability

Provides concrete, executable guidance throughout — specific commands, exact risk patterns, real code snippets (e.g. `exec(\`git commit -m "${commitMessage}"\`)`, `path.join(baseDir, userInput)`), and copy-paste-ready fixes with severity-labeled examples.

3 / 3

Workflow Clarity

Presents a clear sequenced review process with a structured output format (Verdict → Findings → Severity Guide → Summary) and a severity-tiered checkpoint system that acts as validation before merge decisions.

3 / 3

Progressive Disclosure

Well-organized into numbered sections, but it is a single monolithic SKILL.md with no referenced bundle files (no references/scripts/assets exist) and the ~250-line body could split reference material (e.g. example findings, severity guide) into one-level-deep files.

2 / 3

Total

10

/

12

Passed

Description

67%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A specific, well-bounded description that names concrete security review categories, but it lacks an explicit 'Use when...' trigger clause and omits common user-facing phrasings like 'PR review' or 'secrets'.

Suggestions

Add an explicit trigger clause, e.g. 'Use when reviewing PRs for security issues, secrets, or vulnerable code changes.'

Include common natural-language terms users would say, such as 'PR review', 'code review', 'secrets', or 'vulnerabilities'.

DimensionReasoningScore

Specificity

Lists concrete review categories — 'credentials, injection, workflow permissions, supply chain, git operation safety' — naming multiple specific actions rather than vague language.

3 / 3

Completeness

It clearly answers 'what' (reviewing PRs for security across named categories) but there is no 'Use when...' clause or equivalent explicit trigger guidance, which caps completeness at 2 per the judging guidelines.

2 / 3

Trigger Term Quality

Includes relevant terms like 'security', 'credentials', 'injection', and 'supply chain', but is missing common user-facing variations such as 'PR review', 'code review', 'vulnerabilities', or 'secrets' that a user would naturally say.

2 / 3

Distinctiveness Conflict Risk

The security-PR-review niche is clearly bounded with distinct triggers (credentials, injection, workflow permissions, supply chain, git safety), making it unlikely to fire for unrelated skills.

3 / 3

Total

10

/

12

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository
bradygaster/squad
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.