source-code-management

Create or review caddy-security commit messages using repository indicators, required body sections, and timestamped message files. A message request does not create a commit.

Quality

80%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./.codex/skills/source-code-management/SKILL.md

Quality

Content

82%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is a highly actionable, repository-specific rulebook with a template, a worked example, and acceptance criteria, and it wastes almost no tokens on background knowledge. Weaker spots are duplicated indicator guidance, a scattered rather than unified workflow sequence, and an inline catalog that would fit progressive disclosure better in a reference file.

Suggestions

Consolidate the indicator guidance: describe each indicator once in the catalog lists and trim its duplicate prose from the selection rules.

Present the message-creation workflow as one ordered list (inspect diff/status, pick indicator, compose sections, write tmp/commits file, emit git commit -F) ending with a verify-against-acceptance-criteria step.

Move the product-surface and maintenance indicator catalogs plus the legacy-label normalization table into a references/ file (e.g. references/indicators.md), keeping only the selection rules and a short example in SKILL.md.

Dimension	Reasoning	Score
Conciseness	The body is dense, rule-focused, and teaches nothing Claude already knows, but indicator guidance is stated twice — once in the selection rules (e.g. breakfix/fix, tests, skills, ops) and again in the two catalog lists — and the normalization rules partially repeat the catalog, so some trimming is possible.	4 / 5
Actionability	Fully concrete instruction-only guidance: an exact template, a complete worked example, the tmp/commits/YYYYMMDD_HHMM_ file convention, the git commit -F command, 87-character line limits, and per-section body rules leave nothing abstract.	5 / 5
Workflow Clarity	The workflow (inspect diff and git status, choose indicator, compose sections, write the timestamped file, provide git commit -F) is clear and the Acceptance criteria section acts as a validation checklist, but the steps are spread across sections rather than given as one ordered sequence with an explicit verify-against-criteria checkpoint.	4 / 5
Progressive Disclosure	The body is well-sectioned with clear headers and a one-level cross-link to the release-and-versioning skill, and no bundle files are missing since none are referenced. However, the ~70-line indicator catalog and the normalization rules are reference-like material inlined in SKILL.md that could live in a references file.	4 / 5
	Total	17 / 20 Passed

Description

70%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, third-person, and clearly niched to this repository's commit conventions, with a useful scope boundary. Its main weakness is the missing 'Use when...' trigger clause, which caps completeness and leaves natural trigger-term coverage slightly thin.

Suggestions

Add an explicit trigger clause, e.g. 'Use when asked to create or review commit messages for this repository, or when committing staged or unstaged work.'

Include common user phrasings like 'git commit', 'write a commit message', or 'review the diff' to broaden natural trigger-term coverage.

Mention the delivered artifact (the timestamped message file under tmp/commits plus its git commit -F command) so the 'what' fully covers the workflow.

Dimension	Reasoning	Score
Specificity	Names the domain ('caddy-security commit messages') and several concrete actions and artifacts ('repository indicators, required body sections, and timestamped message files'), but omits the subject-line rules and the git commit -F command, so coverage has minor gaps.	4 / 5
Completeness	The 'what' is clear and concrete, but there is no 'Use when...' clause or equivalent trigger guidance — only the boundary note 'A message request does not create a commit' — so 'when' is at best weakly implied.	3 / 5
Trigger Term Quality	Includes the natural phrases users would say ('create or review ... commit messages'), but misses common variations such as 'git commit', 'write a commit message', or 'diff'.	4 / 5
Distinctiveness Conflict Risk	The 'caddy-security' qualifier plus repository-specific indicator and body-section conventions define a clear niche with distinct triggers and minimal overlap with generic commit-message skills.	5 / 5
	Total	16 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
relative_links	Relative link issues: 1 suspicious	Warning

	Total	15 / 16 Passed

Repository: greenpau/caddy-security
Path: .codex/skills/source-code-management/SKILL.md
Commit: a48553d

Reviewed: 9 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.