Content
64%Scale 1-3Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
This is a comprehensive, highly actionable security skill with excellent executable code examples covering OWASP Top 10, input validation, SSRF, LLM security, and more. Its main weaknesses are length (could benefit from splitting detailed patterns into referenced files) and some redundancy between sections (red flags, checklists, and verification overlap significantly). The workflow for actually applying these security measures could be more explicitly sequenced with validation checkpoints.
Suggestions
Move detailed OWASP prevention patterns and code examples into a referenced file (e.g., `references/owasp-patterns.md`) to reduce the main SKILL.md length and improve progressive disclosure.
Consolidate the overlapping 'Red Flags', 'Security Review Checklist', and 'Verification' sections into a single checklist to reduce redundancy and improve conciseness.
Add an explicit workflow with validation checkpoints for applying security hardening to an existing codebase (e.g., '1. Run npm audit → 2. Fix criticals → 3. Grep for secrets → 4. Verify headers → if any fail, loop back').
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The skill is generally well-written but includes some content Claude already knows (e.g., the 'Common Rationalizations' table is motivational rather than instructional, and some OWASP explanations are redundant for Claude). The STRIDE table and threat modeling section add value, but the overall document is quite long (~400 lines) and could be tightened in places like the npm audit decision tree prose and the red flags section which largely duplicates the checklist. | 2 / 3 |
Actionability | Excellent actionability throughout — nearly every section includes executable TypeScript code examples that are copy-paste ready (Zod validation, bcrypt hashing, helmet configuration, rate limiting, SSRF prevention with ipaddr.js). Commands like `npm audit`, `git diff --cached | grep`, and `npm ci` are concrete and specific. The SSRF example even includes a nuanced TOCTOU caveat with mitigation suggestions. | 3 / 3 |
Workflow Clarity | The 'Process: Threat Model First' section provides a clear 4-step sequence, and the npm audit triage has a decision tree. However, the overall document lacks explicit validation checkpoints and feedback loops for the security hardening process itself — there's no 'do X, then verify Y, if it fails do Z' workflow for implementing security controls. The verification checklist at the end is good but disconnected from the implementation steps. | 2 / 3 |
Progressive Disclosure | The document references `references/security-checklist.md` for detailed checklists and pre-commit steps, which is good progressive disclosure. However, the main SKILL.md is very long (~400 lines) and includes substantial inline content (full OWASP patterns, complete code examples for every category, npm audit triage, supply chain hygiene) that could be split into referenced files. The single reference to a bundle file that doesn't exist is also a concern. | 2 / 3 |
Total | 9 / 12 Passed |