security-review

Comprehensive security code review workflow for a target repository, producing a markdown report with findings and recommendations.

Quality

61%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

High

Do not use without reviewing

Fix and improve this skill with Tessl

tessl review fix ./sources/skills/security-review/SKILL.md

Quality

Content

57%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, concise skill with a concrete report template and output spec, but the workflow leans on a bundled guidelines file that is not actually provided and lacks validation checkpoints for a batch repository review. Core analysis guidance is somewhat abstract.

Suggestions

Ship the referenced `Security_Code_Reviewer_Guidelines.md` in the bundle (or remove the reference) — step 1 of the workflow depends on a file that is not bundled, so Claude cannot follow the workflow as written.

Add validation checkpoints to the workflow (confirm rules loaded successfully, handle fetch failures, verify the repo path exists before analysis) since this is a batch operation over an entire repository.

Give step 2 a concrete analysis technique (e.g., specific grep/semgrep patterns or a per-file review checklist) instead of only "review the repository line by line".

Dimension	Reasoning	Score
Conciseness	The body is lean and assumes Claude's competence — no padding about what security review is — with only minor explanatory sentences under the rule URLs that could be trimmed.	4 / 5
Actionability	The report template, output path, and rule-source URLs are concrete, but the core analysis step offers only "review the repository line by line" plus a focus list, and the key referenced bundled file does not exist.	3 / 5
Workflow Clarity	Three steps are sequenced, but this batch operation over an entire repo lacks validation checkpoints (rules loaded? fetch failed? repo path valid?) and error-recovery feedback loops, capping it at 3.	3 / 5
Progressive Disclosure	Five clear sections and one-level external URL references are well signaled, but the in-skill reference to a bundled `Security_Code_Reviewer_Guidelines.md` is a dead reference since the file is absent from the bundle, preventing a higher score.	3 / 5
	Total	13 / 20 Passed

Description

66%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A clear, mostly specific description that names concrete outputs, but it lacks an explicit "Use when..." trigger clause and a few natural synonyms users would say. Distinctiveness is good thanks to the security + report framing.

Suggestions

Add an explicit 'Use when...' trigger clause naming natural user phrases (e.g., 'Use when the user asks for a security review, vulnerability audit, or code security assessment of a repository').

Include common synonyms and cues users say (audit, vulnerability scan, SAST, pentest) to improve trigger discoverability.

Dimension	Reasoning	Score
Specificity	Names the domain and several concrete actions — "security code review workflow", "producing a markdown report", "with findings and recommendations" — with only minor gaps (remediation/prioritization are in the body, not the description).	4 / 5
Completeness	The "what" is clear but there is no "Use when..." clause or equivalent explicit trigger guidance, which caps completeness at 3 per the rubric.	3 / 5
Trigger Term Quality	Contains natural phrases users would say ("security code review", "markdown report", "findings and recommendations") with good coverage, though common synonyms like audit, vulnerability scan, or SAST are missing.	4 / 5
Distinctiveness Conflict Risk	The security focus plus formal-report output gives it a clear niche, with only minor overlap risk against a generic code-review skill.	4 / 5
	Total	15 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: cosai-oasis/project-codeguard
Path: sources/skills/security-review/SKILL.md
Commit: 7e19e20

Reviewed: 11 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.