chatto-security-review

Perform a comprehensive security review of the Chatto codebase. Launch multiple exploration agents in parallel to examine different security aspects, then have an adversarial reviewer verify and challenge the findings.

Quality

77%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

High

Do not use without reviewing

Fix and improve this skill with Tessl

tessl review fix ./.agents/skills/chatto-security-review/SKILL.md

Quality

Content

96%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a tightly written, highly actionable multi-phase security review workflow with concrete agent assignments, file paths, deliverables, and an adversarial verification loop. Its only soft spot is progressive disclosure, which is inherently limited by the single-file, no-bundle structure.

Dimension	Reasoning	Score
Conciseness	Lean and efficient throughout: it assumes Claude's competence, never explains basic concepts, and each line earns its place with dense, actionable focus areas and file paths.	5 / 5
Actionability	Fully actionable guidance — specifies subagent_type, per-agent attack surfaces, exact source file paths, output file locations, and concrete verdict categories (CONFIRMED, CONFIRMED-DOWNGRADE, etc.).	5 / 5
Workflow Clarity	Clear four-phase sequence with an explicit adversarial verification loop in Phase 3 that re-checks findings against source code, and a structured final-report checklist in Phase 4.	5 / 5
Progressive Disclosure	Well-organized into clearly headed phases with no nested references and no bundle files to navigate; solid structure, though as a single self-contained file it does not exercise multi-level progressive disclosure.	4 / 5
	Total	19 / 20 Passed

Description

58%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description concretely states what the skill does and ties it to a specific codebase, but omits any 'when to use' trigger guidance and lacks natural user-facing trigger terms. This limits its discoverability and completeness despite reasonable specificity.

Suggestions

Add a 'Use when...' clause stating when Claude should invoke this skill, e.g. 'Use when the user asks to audit, pentest, or find vulnerabilities in the Chatto codebase.'

Include natural user-facing trigger terms and synonyms like 'security audit,' 'vulnerability scan,' 'pentest,' or 'threat review.'

Tighten the action list to more concrete verbs (e.g. enumerate each attack-surface agent) to push specificity from 4 toward 5.

Dimension	Reasoning	Score
Specificity	Lists several concrete actions — 'security review,' 'Launch multiple exploration agents in parallel,' 'verify and challenge the findings' — though they remain somewhat high-level compared to a fully enumerated action list.	4 / 5
Completeness	Has a clear 'what' (comprehensive multi-agent security review with adversarial verification) but no 'Use when...' trigger clause, capping completeness at 3 per the rubric.	3 / 5
Trigger Term Quality	Contains 'security review' and 'Chatto codebase' but misses common natural user phrasings like 'audit,' 'find vulnerabilities,' or 'pentest,' and lacks synonyms.	3 / 5
Distinctiveness Conflict Risk	Tied specifically to 'the Chatto codebase,' giving it a clear niche with minimal conflict risk, though it could still overlap with generic security-review skills.	4 / 5
	Total	14 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: chattocorp/chatto
Path: .agents/skills/chatto-security-review/SKILL.md
Commit: 967a9a1

Reviewed: 5 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.