Content
50%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The body is well-structured as an index: always-apply rules, a tag-to-rule mapping table, and a language-to-rule mapping table all route the agent to rule files in a rules/ directory. However, the payload of the skill lives in rule files that are absent from this bundle, validation steps are implicit rather than concrete, and several sections (When to Use, Proactive Security, Usage Workflow) duplicate the description or restate knowledge Claude already has.
Suggestions
Ship the referenced rules/ directory (or relocate rule files under references/) so the ~30 mapped rule files actually resolve; the mapping tables currently navigate to nonexistent paths.
Cut the 'When to Use This Skill' section (it duplicates the frontmatter description) and the 'Proactive Security' bullet list of generic principles Claude already knows.
Add a concrete validation step in the Security Review phase — e.g., a checklist of specific checks per applied rule and what to do when a check fails — instead of the vague 'Validate that all the rules have been successfully followed'.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The mapping tables are dense and earn their tokens, but the 'When to Use This Skill' section restates the description, the 'Usage Workflow' re-explains the tag/language tables, and 'Proactive Security' lists generic principles Claude already knows ('Use parameterized queries', 'Apply least-privilege principles'). | 3 / 5 |
Actionability | Concrete file-level guidance exists (three always-apply rule files, explicit tag-to-file and language-to-file mapping tables), but there are no code examples, no sample application of a rule, and the actual rule content lives in a 'rules/' directory that is not present in this bundle, leaving key details unverifiable. | 3 / 5 |
Workflow Clarity | A clear three-phase sequence exists (Initial Security Check -> Code Generation -> Security Review), but the review checkpoints are soft and implicit ('Validate that all the rules have been successfully followed', 'Verify no hardcoded credentials') with no concrete validation commands or failure-handling steps. | 3 / 5 |
Progressive Disclosure | References to the 'rules/' directory are one level deep and clearly signaled via the mapping tables, but none of the ~30 referenced rule files exist in the bundle (no references/ or rules/ directory is present), so the navigation points at unverifiable paths; the 'Usage Workflow' section also opens with an empty lead-in heading. | 3 / 5 |
Total | 12 / 20 Passed |