security-review

Skill do Security Reviewer para auditoria de segurança e boas práticas. Use quando precisar revisar código para vulnerabilidades, validar implementação de auth, checar OWASP Top 10, revisar CORS/CSRF/XSS, garantir DRY e clean code, ou qualquer review de segurança. Trigger em: "segurança", "security review", "vulnerabilidade", "OWASP", "XSS", "CSRF", "CORS", "injection", "HttpOnly", "cookie seguro", "DRY", "code review", "boas práticas", "audit", "pentest", "sanitização".

Quality

80%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Medium

Suggest reviewing before use

Fix and improve this skill with Tessl

tessl review fix ./skills/06-security-review/SKILL.md

Quality

Content

68%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable with copy-paste-ready code and templates, and it points to one-level-deep reference files for persona/policy details. Its weaknesses are token inefficiency from inlining large checklist/code blocks that belong in referenced files, and the absence of an explicit ordered review workflow with validation feedback loops.

Suggestions

Add an explicit sequenced workflow (e.g., 1. receive diff/artifacts -> 2. run OWASP checklist -> 3. run npm audit -> 4. classify findings -> 5. re-validate fixes -> 6. handoff) with validation checkpoints so the review process has feedback loops.

Move the full code blocks (security-headers.ts, next.config.js, CORS, CSRF, XSS) and the complete OWASP Top 10 checklist into a referenced file such as docs/skill-guides/security-review.md, keeping only a concise summary and a pointer inline in SKILL.md.

Tighten redundant sections: the 'Código Limpo' section restates the DRY/Clean Code checklist's comment guidance, and 'Integração com Pipeline' duplicates cross-skill coordination already implied by the orchestrator policy.

Dimension	Reasoning	Score
Conciseness	The body is mostly actionable and not padded with beginner explanations, but it inlines large reference blocks (full OWASP Top 10 checklists, complete headers/CORS/CSRF/XSS TypeScript snippets, a full report template) that inflate the SKILL.md rather than deferring to reference files. It is efficient in places but could be tightened by moving bulk content out.	3 / 5
Actionability	Highly executable: provides copy-paste-ready TypeScript for security headers, CORS, CSRF, XSS, a DOMPurify sanitize call, a complete markdown report template, and concrete dependency-management commands ('npm audit fix', override steps). Code examples cover the common cases.	5 / 5
Workflow Clarity	Sections like 'Handoff para Deployer' and 'Gerenciamento de Dependencias' give ordered gate conditions, and the OWASP checklist is itemized, but there is no end-to-end review sequence with explicit validation checkpoints / feedback loops (validate-findings -> fix -> re-review). This is a destructive/impactful review context where the validation cap applies, capping at 3.	3 / 5
Progressive Disclosure	Structure is reasonable with section headers and clear one-level-deep references to separate files ('docs/skill-guides/security-review.md', 'personas/security-auditor.md', and several 'policies/*.md' files), though some content that could live in those references (full code blocks, full checklist) is inlined in the SKILL.md itself.	4 / 5
	Total	15 / 20 Passed

Description

91%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is strong: it concretely names what the skill does and provides an explicit 'Use when' clause plus a thorough list of natural trigger terms. The main weakness is the broad catch-all 'qualquer review de segurança' and generic 'code review'/'boas práticas' triggers that slightly raise overlap risk.

Dimension	Reasoning	Score
Specificity	Lists several concrete actions ('revisar código para vulnerabilidades', 'validar implementação de auth', 'checar OWASP Top 10', 'revisar CORS/CSRF/XSS', 'garantir DRY e clean code') rather than vague language, though 'qualquer review de segurança' is a generic catch-all that leaves minor coverage gaps.	4 / 5
Completeness	Explicitly answers both 'what' (auditoria de segurança, validar auth, checar OWASP, revisar CORS/CSRF/XSS, garantir DRY/clean code) and 'when' via the explicit 'Use quando precisar...' clause plus a dedicated 'Trigger em:' list of concrete trigger phrases.	5 / 5
Trigger Term Quality	Comprehensive trigger coverage with natural terms, synonyms, and technical keywords users would say ('segurança', 'security review', 'vulnerabilidade', 'OWASP', 'XSS', 'CSRF', 'CORS', 'injection', 'pentest', 'sanitização', 'code review').	5 / 5
Distinctiveness Conflict Risk	Mostly distinct niche (security review / OWASP / auth validation) with trigger terms specific to that domain, but the broad 'code review' / 'boas práticas' / 'DRY' triggers create minor overlap risk with a generic code-review skill.	4 / 5
	Total	18 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
allowed_tools_field	'allowed-tools' contains unusual tool name(s)	Warning

	Total	15 / 16 Passed

Repository: felvieira/claude-skills-fv
Path: skills/06-security-review/SKILL.md
Commit: f3492ef

Reviewed: 5 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.