CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

security-audit

Deep security audit covering OWASP Top 10, authentication, authorization, data protection, dependency vulnerabilities, and secrets scanning. Delegates to the Centinela (QA) agent.

Quality

71%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./plugins/agent-triforce/skills/security-audit/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

65%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is concise and well-structured for a delegating skill, but actionability and workflow clarity are held back by referenced checklists that are not defined and by the absence of validation checkpoints in the batch audit process. Progressive disclosure is excellent for a short single-purpose skill.

Suggestions

Define or link the referenced checklists (SIGN IN, TIME OUT, Non-Normal emergency) inline or via a reference file so Claude has the actual audit steps, not just their names.

Add explicit validation/verification checkpoints to the workflow (e.g. 'After the scan, confirm every OWASP category A01-A10 was evaluated before writing the report').

Make the numbered 'What This Skill Does' list an executable workflow with concrete commands or agent-delegation calls rather than a description of agent behavior.

DimensionReasoningScore

Conciseness

The body is lean with no concept over-explanation, but the Example and Tips sections carry a little content that could be tightened slightly.

4 / 5

Actionability

Provides concrete invocation forms ('/security-audit', '/security-audit src/auth/') and an output path, but references checklists (SIGN IN, TIME OUT, Non-Normal) that are never defined here, leaving key execution details implicit.

3 / 5

Workflow Clarity

An 8-step sequence is listed, but it describes what the agent does rather than a workflow with validation checkpoints; as a batch operation with no feedback loops, workflow clarity is capped at 3.

3 / 5

Progressive Disclosure

Under 50 lines, single-purpose, no external references needed, and well-organized into clearly labeled sections, satisfying the simple-skill exception for a top score.

5 / 5

Total

15

/

20

Passed

Description

66%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description clearly states what the skill does and lists comprehensive coverage areas, but omits any explicit 'Use when...' trigger guidance, which caps completeness and limits when-to-use clarity. It is specific and largely distinct from other skills.

Suggestions

Add an explicit 'Use when...' clause with concrete triggers, e.g. 'Use when running a pre-release security review, after auth/data-handling changes, or when the user asks for a security audit, secrets scan, or vulnerability check.'

Include common synonyms users say ('pentest', 'security review', 'CVE scan') alongside the existing keywords to broaden natural-language triggering.

Consider phrasing coverage as discrete actions ('scans for secrets', 'audits dependencies for CVEs') rather than only naming domains.

DimensionReasoningScore

Specificity

Names six concrete coverage areas ('OWASP Top 10, authentication, authorization, data protection, dependency vulnerabilities, and secrets scanning'), which is several specific actions, though they are framed as coverage domains rather than discrete verbs.

4 / 5

Completeness

Has a clear 'what' (deep security audit covering listed areas) but no 'Use when...' clause or equivalent explicit trigger guidance, so completeness is capped at 3 per the rubric guideline.

3 / 5

Trigger Term Quality

Includes natural keywords a user would say ('security audit', 'secrets scanning', 'vulnerabilities') plus technical anchors (OWASP Top 10), but misses common synonyms like 'pentest', 'security review', or 'CVE'.

4 / 5

Distinctiveness Conflict Risk

The security-audit niche plus 'Delegates to the Centinela (QA) agent' is mostly distinct with only minor overlap risk against general code-review skills.

4 / 5

Total

15

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository

davepoon/buildwithclaude

Path

plugins/agent-triforce/skills/security-audit/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.