Content
70%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
This is an exceptionally thorough and actionable OWASP audit skill with genuinely novel, non-obvious security patterns and concrete executable guidance throughout. Its primary weakness is its monolithic structure — at 600+ lines with no external file references, it consumes enormous context window space and would benefit greatly from splitting detailed reference material (SSRF bypass catalog, XSS payloads, header tables, report templates) into separate files. Some sections also contain verbose explanations that could be tightened.
Suggestions
Split the SSRF allow-list bypass catalog (A10), XSS payload test set, security header baseline table, and report format template into separate referenced files (e.g., SSRF_BYPASSES.md, XSS_PAYLOADS.md, HEADERS.md, REPORT_TEMPLATE.md) to reduce the main file to an overview with clear navigation.
Tighten verbose explanatory passages — e.g., the A02 TLS/VERIFY_PEER section and A04 TOCTOU billing section contain multi-paragraph explanations that could be condensed to bullet points with a code example, since Claude understands these concepts.
Remove or consolidate duplicated grep patterns that appear in multiple sections (e.g., redirect-related greps in A01, cookie/credential greps in A07) into a single 'comprehensive grep sweep' section or reference file.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The skill contains genuinely novel, non-obvious security patterns (IDOR via foreign keys, JSON.stringify breakout, IPv4 octal encoding, TOCTOU races) that earn their tokens. However, it is extremely long (~600+ lines) with some redundancy (e.g., the same grep patterns repeated, verbose explanations of concepts like SSRF allow-list bypasses that Claude likely knows). Several sections could be tightened or moved to reference files. | 2 / 3 |
Actionability | Exceptionally actionable throughout — provides concrete grep commands, executable bash snippets, specific regex patterns for secret detection, exact code fixes (e.g., Rails ERB JSON-LD idiom, conditional UPDATE SQL patterns), canonical XSS payload test sets, and framework-specific file paths to check. Nearly every checklist item includes a concrete 'grep for' or code example. | 3 / 3 |
Workflow Clarity | The workflow is clearly sequenced: scope → systematic checklist (A01-A10) → verify fixes at runtime → second-opinion pass → report format. It includes explicit validation checkpoints (runtime verification after fixes, XSS payload testing, second-pass adversarial review) and feedback loops (fix → re-validate → re-audit). The report format section provides clear templates with required fields. | 3 / 3 |
Progressive Disclosure | This is a monolithic wall of text with no references to external files despite being extremely long (~600+ lines). The detailed SSRF bypass catalog, the XSS sanitizer guidance, the framework-specific header tables, and the report template could all be split into separate reference files. Everything is inline, making it difficult to navigate and consuming excessive context window. | 1 / 3 |
Total | 9 / 12 Passed |