Content
88%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A strong, highly actionable audit skill: concrete thresholds, grep patterns, and commands throughout, with a well-sequenced verify-then-record-validate workflow and a real, well-structured reference bundle. The main costs are minor: a few trimmable known-concept explanations and noticeable duplication of the shared findings-format content that lives in references/.
Suggestions
Trim explanations of concepts Claude already knows (e.g., the "< 50 people on Earth" flourish, the Mersenne Twister aside, the ECB block-pattern parenthetical) — keep the verdict and the threshold, drop the rationale.
Drop the restated verdict semantics, JSON-first rule, and validate/SARIF command blocks that duplicate references/findings-format.md; keep the crypto-specific verdict examples and a single pointer.
Move the ~40-line Output Format report template into a reference file (e.g., references/report-template.md), leaving a short inline summary of the section headings.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is dominated by dense, non-obvious audit specifics (grep patterns, OWASP 2024 iteration floors, the Java/PyCryptodome default-ECB gotchas, fingerprint rules), but includes a few trimmable explanations of concepts Claude already knows: "There are < 50 people on Earth who can design new crypto safely, and they don't work at your company", "Math.random() (Node — Mersenne Twister, predictable)", and the ECB block-pattern aside. Not 3 because the unnecessary explanation is minor relative to the high-signal content. | 4 / 5 |
Actionability | Fully executable throughout: per-category grep patterns (`AES.*ECB`, `pkcs1_v1_5`, `jwt.decode`, `mt_rand`), runnable commands (`testssl.sh https://target`, `sslyze --regular target`, `aws kms get-key-policy`, `node references/validate-findings.mjs findings.json`, `curl --tlsv1.3 --tls-max 1.3`), exact thresholds (PBKDF2 ≥ 600,000 iterations, bcrypt cost ≥ 12, scrypt N=2^17, 96-bit GCM nonces, 128-bit token floor), and concrete confirmed/needs_validation/rejected examples with real file paths. Not 4: copy-paste-ready guidance covers the common cases end to end. | 5 / 5 |
Workflow Clarity | Clear sequence with explicit validation checkpoints: checklist greps → refutation pass ("Before anything is `confirmed`, run the refutation pass in references/verification.md") → findings.json sorted by fingerprint and validated before rendering → runtime fix verification ("Test encryption / decryption round-trip after every change", rehash-on-login migration plans, testssl verification of TLS changes). Not 4: checkpoints and feedback loops are explicit at every stage, including fix-time. | 5 / 5 |
Progressive Disclosure | All six referenced bundle files exist, are one level deep, and are clearly signaled with links and a stated purpose at each point of use; the core crypto checklist appropriately stays in SKILL.md. Not 5: the body restates verdict semantics, the JSON-first rule, and the exact validate/SARIF commands already covered by references/findings-format.md, and the ~40-line Output Format report template is inlined rather than split out — minor organization gaps against the actual bundle structure. | 4 / 5 |
Total | 18 / 20 Passed |