Content
92%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
An exceptionally well-constructed procedural skill: executable commands at every step, a clearly sequenced workflow with validation and feedback loops, and proper deferral of bulk material to real, well-signaled one-level-deep reference files. The only weakness is token weight — at ~300 lines a few sections (intro statistics, the self-audit section) could be tightened or pushed to references.
Suggestions
Trim the intro's Liu et al. (2026) statistics to a single clause (or move them to a reference) — the threat model stands without the numbers, saving ~4 lines of context.
Compress the 'Eat your own dog food' section to its three actionable bullets; the framing sentence about installing into .claude/skills/ duplicates Step 0 scope guidance.
Move the Step 3 hooks/settings grep block (the S variable and five rg commands) into references/content-checks.md alongside the other pattern sets, keeping only the 'What to weigh' table inline.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is dense and nearly every line is load-bearing — path tables, grep commands, severity anchors — and it assumes Claude's competence rather than teaching basics (the one-sentence framing of 'a hook is a shell command that runs on every prompt' motivates the threat model rather than explaining known concepts). A few sections could still be trimmed: the Liu et al. (2026) statistics in the intro and the self-referential 'Eat your own dog food' section are the closest things to padding, which lands it at the 'efficient; minor instances of over-explanation' anchor rather than the lean score-5 anchor. | 4 / 5 |
Actionability | Fully executable guidance throughout: copy-paste ripgrep commands per check category, concrete settings/MCP grep blocks with exact paths, a pinned-vs-unpinned args example ('["-y", "@acme/mcp-server@1.4.2"]'), a validator invocation ('node references/validate-findings.mjs findings.json'), an exact fingerprint format, and a rendered report template. It even preempts the markdown-escaping pitfall ('\| is markdown escaping — type a plain | in the shell'), matching the 'copy-paste ready' score-5 anchor. | 5 / 5 |
Workflow Clarity | Steps 0–6 are clearly sequenced (authorization/scope → inventory → content checks → hooks/settings → MCP → optional scanner → verdicts/output) with explicit validation checkpoints and feedback loops: 'Fix every error before writing prose' after the findings.json validation, rejected candidates recorded 'so later runs stay quiet', and needs_validation items carrying a concrete validation plan. This matches the score-5 anchor's validate → fix → retry structure. | 5 / 5 |
Progressive Disclosure | Textbook progressive disclosure: the body keeps one representative pattern per category and defers the full set ('the full set, with portable grep / perl equivalents, is in references/content-checks.md'), and the headline path table while pointing to per-agent tables in references/locations.md. All four referenced files (locations.md, content-checks.md, findings-format.md, severity-calibration.md) plus validate-findings.mjs exist in references/ and are one level deep, well-signaled at the point of use — matching the score-5 anchor, with only inline density (not nesting or buried references) keeping it from being a trivial call. | 5 / 5 |
Total | 19 / 20 Passed |