security-review

MANDATORY procedure for any pr_review task whose rubric is `pr-security-v1` or whose prompt asks for a security review. Read this skill FIRST before reading the PR diff. Defines the sequential recon → hunt → self-validate → trace → dedup → report pipeline a single agent must run against a PR. Without it, the review will be incomplete and the structured output will be rejected.

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Quality

Content

88%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-sequenced pipeline skill with strong validation checkpoints and concrete commands. The main weakness is mild redundancy in the anti-patterns section and an opportunity to offload detailed catalogs to referenced files.

Suggestions

Consolidate the 'Anti-patterns to avoid' section — most bullets restate rules already in the Pipeline phases (single PR comment, score-the-diff-not-codebase, reachability call, Semgrep citation); trim to only net-new guidance or fold back into the phases.

Extract the MoltNet-specific risk-surface catalog and/or the Report-phase comment template into a referenced file (e.g. references/risk-surfaces.md) so SKILL.md stays a lean overview with one-level-deep, clearly signaled references.

Dimension	Reasoning	Score
Conciseness	Mostly tight and operational with concrete commands and no explanation of basics Claude already knows; the 'Anti-patterns to avoid' section restates rules already specified in the Pipeline phases (single comment, score-the-diff, reachability call, Semgrep citation), which is trimmable redundancy.	4 / 5
Actionability	Provides copy-paste-ready `gh pr` commands, named tools, exact per-phase outputs, and a fully specified report structure with literal header text and ordered sections — concrete and executable guidance throughout.	5 / 5
Workflow Clarity	Six phases are explicitly sequenced with required per-phase outputs and real validation/feedback loops (Phase 3 CONFIRMED/REFUTED/UNCERTAIN, Phase 4 chain-break → REFUTED, downgrade-on-uncertainty), satisfying the destructive/batch validation requirement even though the task itself is advisory.	5 / 5
Progressive Disclosure	Well-organized single-file structure with clear section headers and no nested references; not a 5 because at ~145 lines the MoltNet risk-surface catalog and Report comment template could be split into one-level-deep referenced files to keep SKILL.md a leaner overview.	4 / 5
	Total	18 / 20 Passed

Description

87%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that clearly states both what the skill does and when to invoke it, anchored by a distinct rubric id trigger. Minor room to broaden natural-language trigger synonyms beyond the technical rubric name.

Dimension	Reasoning	Score
Specificity	Enumerates the concrete pipeline phases ('recon → hunt → self-validate → trace → dedup → report') and names the procedure, listing several specific actions; not a 5 because the actions are phase labels rather than fully elaborated operations.	4 / 5
Completeness	Explicitly answers both 'what' ('Defines the sequential recon → hunt → self-validate → trace → dedup → report pipeline') and 'when' ('MANDATORY procedure for any pr_review task whose rubric is `pr-security-v1` or whose prompt asks for a security review') with concrete trigger phrases.	5 / 5
Trigger Term Quality	Includes natural and technical triggers ('pr_review task whose rubric is `pr-security-v1`', 'prompt asks for a security review', 'PR diff') with good keyword coverage; not a 5 because it leans on the technical rubric id rather than comprehensive natural synonyms.	4 / 5
Distinctiveness Conflict Risk	Narrowly scoped to a single named rubric (`pr-security-v1`) and explicit security-review triggers, giving it a clear niche with minimal conflict risk against other skills.	5 / 5
	Total	18 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: getlarge/themoltnet
Path: skills/security-review/SKILL.md
Commit: 5daa9ca

Reviewed: ~14 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.