CtrlK
BlogDocsLog inGet started
Tessl Logo

review-security

Use when reviewing a branch diff for security concerns — auth, tokens and sessions, injection, secrets, cookies, CSP and third-party content — and reporting findings with S-C/H/M/L IDs in the four-field format.

68

Quality

82%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

81%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

An unusually actionable skill: concrete commands, a verbatim report skeleton, a routing table, and validation checkpoints with an explicit recovery loop. Its weakness is token efficiency — heavy rhetorical repetition and triple-stated shape warnings — and a main file that holds more inline checklist detail than the reference split would suggest.

Suggestions

State the shape rule once and reference it: the four-heading constraint and 'edit, never rewrite' warning are fully delivered three times (Step 0, the Step 2 mid-run check, the final check); one statement plus the two command checks would cut substantial tokens.

Trim justificatory prose in Step 0 and the bullet intros (e.g. the paragraph explaining why writing the skeleton first matters) to single sentences — the imperative plus one reason is enough for a competent model.

Consider moving the JWT options subsection (the three numbered rules and their rationale) into references/checklists.md next to the Token sections it extends, keeping only the tabulation instruction inline.

DimensionReasoningScore

Conciseness

It never explains concepts Claude already knows and all content is repo-specific, but it is noticeably padded with rhetorical justification that could be tightened — e.g. "a run that leaves a differently-shaped file has produced nothing, however good the analysis inside it", "that is the one way this run fails outright however good the analysis is", and the shape-check warning delivered three times (Step 0, the mid-run check, the final check). Not a 2 because the padding is emphatic domain guidance rather than generic explanation.

3 / 5

Actionability

Fully executable throughout: copy-paste commands ("BASE=$(git config --get branch.$(git branch --show-current).gh-merge-base || echo main)", "grep -c '^## \(Security findings\|Compliance findings\|Coverage\|Sections checked\)$' SECURITY-REVIEW.md"), a verbatim heredoc report skeleton, a grep-to-section routing table, and an exact finding template with a worked example ("**S-H1** — <short title>"). Not below 5: no pseudocode, and the common cases are covered.

5 / 5

Workflow Clarity

A clearly sequenced multi-step process (Step 0 skeleton → Step 1 route the diff → Step 2 work mandatory sections → report shape) with explicit validation checkpoints and a feedback loop: the mid-run "It must print `4`. If it prints less … restore the 4 headings, put the finding back under the right one", repeated as a final check with both counts. Anti-drift: it matches anchor 5's validate-recover-checklist pattern exactly, not anchor 4 which allows missing checkpoints.

5 / 5

Progressive Disclosure

References are one level deep and well signaled — "Nine more sections live in `references/checklists.md`" with all nine named, plus `references/compliance.md`, and both files exist and contain exactly those sections. Not a 5 because the main file carries ~270 lines of inline checklist bulk (Auth & Authorisation, the long JWT subsection, Cookies) that is the kind of content the rubric expects split out, even though the body justifies the split by routing frequency; not a 3 since the split that exists is deliberate and clearly navigable.

4 / 5

Total

17

/

20

Passed

Description

83%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description with an explicit 'Use when…' clause, concrete trigger phrases, and a specific output format. Its main weakness is scope omission: the skill body devotes a large section to compliance findings (C- IDs, GDPR/CCPA/EAA), none of which appears in the description, so compliance-oriented requests would not trigger it.

Suggestions

Add compliance trigger terms (e.g. 'privacy', 'GDPR', 'accessibility', 'compliance findings with C- IDs') so the description covers the compliance half the body actually delivers.

Include common synonyms users say for security review — 'vulnerabilities', 'secure code review', 'XSS', 'CSRF', 'OWASP' — to broaden natural trigger coverage.

Disambiguate from a general code-review skill by stating upfront that this is security/compliance-only review, not general code quality review.

DimensionReasoningScore

Specificity

Names two concrete actions ("reviewing a branch diff for security concerns" and "reporting findings with S-C/H/M/L IDs in the four-field format") plus a specific concern list ("auth, tokens and sessions, injection, secrets, cookies, CSP and third-party content"). Not a 5 because coverage is incomplete: the skill's substantial compliance half (GDPR/CCPA/EAA, C- findings) is absent, so the described capabilities are not comprehensive.

4 / 5

Completeness

Explicitly answers both questions with concrete trigger phrases: the what ("reviewing a branch diff for security concerns … reporting findings with S-C/H/M/L IDs") and the when ("Use when reviewing a branch diff for security concerns — auth, tokens and sessions, injection, secrets, cookies, CSP and third-party content"), mirroring the anchor-5 pattern. Not below 5 since both halves are explicit; the compliance omission is scored under specificity/trigger terms.

5 / 5

Trigger Term Quality

Good natural keyword coverage — "security", "auth", "tokens", "cookies", "injection", "secrets" are phrases users would actually say when needing this skill. Not a 5 because common synonyms and variations are missing: "vulnerabilities", "secure code review", "XSS", "CSRF", "OWASP", and any compliance/privacy trigger the body actually handles.

4 / 5

Distinctiveness Conflict Risk

A clear niche (security review of a diff) with distinct domain terms ("__Host-"-style cookie/auth/CSP vocabulary would not fire a PDF or general document skill). Not a 5 because "reviewing a branch diff" is a phrase shared with a general code-review skill, leaving minor overlap risk on generic review requests; not a 3 since the explicit "for security concerns" qualifier disambiguates.

4 / 5

Total

17

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
englishstventures/osn
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.