codeguard

A CodeGuard security skill that helps AI coding agents write secure code and prevent common vulnerabilities. Use this skill when writing, reviewing, or modifying code to ensure secure-by-default practices are followed.

Quality

61%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/codeguard/SKILL.md

Quality

Content

56%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a well-structured dispatcher with a clear workflow and concrete rule references, but it is token-heavy due to inlined reference tables and redundant explanations of well-known security concepts.

Suggestions

Move the 25-language mapping table into a separate reference file (e.g. LANGUAGE_RULES.md) and keep only the dispatch logic inline, to recover token budget.

Remove the "Proactive Security" bullet list (parameterized queries, sanitize input, least-privilege) since these are concepts Claude already knows; the rule files already encode them.

Consolidate the "When to Use This Skill" section with the frontmatter description to avoid restating the same triggers twice.

Dimension	Reasoning	Score
Conciseness	The body is noticeably verbose: a 25-row language table and a tag table are inlined as bulk reference data, and the "Proactive Security" list re-explains concepts Claude already knows (parameterized queries, input sanitization, least-privilege).	2 / 5
Actionability	As an index/dispatcher it gives concrete, executable guidance: exact rule filenames per tag and language plus a workflow with explicit checks ("Will this handle credentials? → Apply codeguard-1-hardcoded-credentials"), with only minor gaps.	4 / 5
Workflow Clarity	A clear before/while/after sequence (Initial Security Check → Code Generation → Security Review) with validation checkpoints in the review phase (verify no hardcoded credentials, validate rules followed); minor gaps only.	4 / 5
Progressive Disclosure	Structure is decent with one-level-deep references to rule files in rules/, but two large mapping tables are inlined in the overview that would be better split into a separate reference file.	3 / 5
	Total	13 / 20 Passed

Description

66%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description clearly states what the skill does and when to use it with an explicit trigger clause, but the triggers are overly broad (all coding) and the actions are somewhat generic, limiting distinctiveness and specificity.

Suggestions

Tighten the "when" clause to security-relevant contexts (e.g. "Use when implementing auth, crypto, input handling, or handling secrets/credentials") to reduce overlap with general coding skills.

Replace generic actions with concrete capabilities (e.g. "apply per-language security rule sets, flag hardcoded secrets, validate crypto algorithm choices").

Add a few natural trigger synonyms users say ("security review", "vulnerabilities", "secure coding") to improve trigger term coverage.

Dimension	Reasoning	Score
Specificity	Names the security domain and a couple of concrete actions ("write secure code", "prevent common vulnerabilities", "ensure secure-by-default practices are followed"), but the actions are high-level and not comprehensive.	3 / 5
Completeness	Has a clear "what" (helps agents write secure code and prevent vulnerabilities) and an explicit "Use this skill when" clause with concrete triggers; the "when" could be more specific about security-sensitive contexts.	4 / 5
Trigger Term Quality	Includes natural phrases users actually say ("writing, reviewing, or modifying code") with good coverage, though a few natural synonyms (e.g. "security review", "vulnerabilities") are missing.	4 / 5
Distinctiveness Conflict Risk	The "CodeGuard security" framing carves a clear niche, but the trigger "writing, reviewing, or modifying code" is broad enough to overlap with virtually any coding skill.	3 / 5
	Total	14 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: cosai-oasis/project-codeguard
Path: skills/codeguard/SKILL.md
Commit: 7e19e20

Reviewed: 11 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.