security-audit

OWASP Top 10 and STRIDE security auditing with supply chain analysis. Triggers on "security audit", "security scan", "cso".

Quality

72%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./.claude/skills/security-audit/SKILL.md

Quality

Content

57%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

Well-organized overview with a clear phased workflow and lean prose, but it is undermined by references to bundle files that are missing and by the absence of validation checkpoints in a batch scanning process. The skill reads as an index whose linked detail pages do not exist.

Suggestions

Add the missing referenced files (phases/01-04, specs/scoring-gates.md, specs/owasp-checklist.md, _shared/SKILL-DESIGN-SPEC.md) or inline the essential per-phase steps so the skill is self-contained.

Insert explicit validation checkpoints between phases, e.g. verify supply-chain-report.json / owasp-findings.json are well-formed and non-empty before advancing to the next phase, with a fix-and-retry loop on failure.

Expand the inline actionable detail for Phase 1 and Phase 3 (concrete commands and detection patterns) rather than relying solely on the absent phase files, since the body currently cannot execute those phases on its own.

Dimension	Reasoning	Score
Conciseness	The body is lean and assumes Claude's familiarity with OWASP/STRIDE, but the large ASCII architecture diagram and slight repetition between 'Key Design Principles' and 'Phase Sequence' could be trimmed.	4 / 5
Actionability	Concrete commands appear (mkdir, WORK_DIR, ccw cli invocation, npm audit/pip-audit/safety check), but the per-phase executable detail is delegated to phases/.md and specs/.md files that do not exist, leaving key steps incomplete.	3 / 5
Workflow Clarity	The 4-phase sequence is clearly laid out with a flow diagram and modes, but a security scan is a batch operation with no explicit validate/verify checkpoints between phases, capping the score at 3 per the destructive/batch guideline.	3 / 5
Progressive Disclosure	Structure and signaling are good (overview plus a Reference Documents table with one-level-deep links), but every referenced path (phases/, specs/, _shared/) points to a file that is absent from the bundle, so navigation is broken in practice.	3 / 5
	Total	13 / 20 Passed

Description

87%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that explicitly answers both what the skill does and when to invoke it, with natural trigger phrases and a distinct niche. Minor room to expand trigger synonyms and enumerate a few more concrete actions.

Dimension	Reasoning	Score
Specificity	Names several concrete actions ('OWASP Top 10', 'STRIDE security auditing', 'supply chain analysis') covering the security-audit domain, falling just short of the comprehensive 5-anchor which expects more enumerated actions.	4 / 5
Completeness	Clearly states what the skill does and provides explicit 'Triggers on "security audit", "security scan", "cso"' trigger guidance, matching the anchor that requires concrete trigger phrases for both what and when.	5 / 5
Trigger Term Quality	'security audit' and 'security scan' are natural phrases users say and 'cso' adds a niche term, but common synonyms like 'vulnerability scan', 'pentest', or 'threat model' are missing.	4 / 5
Distinctiveness Conflict Risk	The OWASP Top 10 + STRIDE + supply chain framing carves a clear niche with distinct triggers, giving minimal overlap with general code-review skills.	5 / 5
	Total	18 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
allowed_tools_field	'allowed-tools' contains unusual tool name(s)	Warning
relative_links	Relative link issues: 11 missing	Warning

	Total	14 / 16 Passed

Repository: catlog22/Claude-Code-Workflow
Path: .claude/skills/security-audit/SKILL.md
Commit: 07491b0

Reviewed: 1 day ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.