security

How to handle `GRIDA-SEC-<id>` security boundaries in the Grida repo. Triggers when you encounter a `GRIDA-SEC` tag in source/docs, when modifying files under any tagged path, or when adding a new prevented- vulnerability record. Each `GRIDA-SEC-<id>` identifies a structural trust boundary documented in `/SECURITY.md`. This skill explains the contract, mandates a security review before committing changes to any tagged file, and shows how to register a new id. Use whenever "GRIDA-SEC" appears in context.

Quality

86%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

81%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, actionable skill body with an excellent gated review workflow and concrete grep commands. Minor gains are available in trimming the negative-guidance section and templating the SECURITY.md entry shape.

Suggestions

Tighten the 'When NOT to use this convention' section into a compact bulleted list to recover tokens without losing the boundary guidance.

Add a short fill-in template for a /SECURITY.md entry (the four-section shape) so the 'Adding a new id' workflow is fully copy-paste ready rather than described.

Make the 'walk the enforcement mechanism' review step more concrete by showing the expected form of the per-step confirmation (e.g., a one-line checklist format).

Dimension	Reasoning	Score
Conciseness	The body is efficient and assumes Claude's competence (it contrasts GRIDA-SEC with CVE in one line rather than lecturing), but the 'When NOT to use' section and closing test paragraph add length that could be trimmed slightly, so it sits below the every-token-earns-its-place bar of 5.	4 / 5
Actionability	Provides copy-paste-ready commands (`grep -rn GRIDA-SEC-<id> .`, the test-file grep variant) and concrete numbered steps for review and registration; the 'walk the enforcement mechanism' step remains somewhat abstract guidance, leaving a minor gap below fully executable.	4 / 5
Workflow Clarity	The mandatory-review workflow is a clear numbered checklist (steps 1–5) with an explicit validation gate ('If you cannot satisfy steps 1–4, do not commit') and a feedback loop (revert, or amend SECURITY.md and surface it), and the registration flow ends with a verification step ('Verify the grep works').	5 / 5
Progressive Disclosure	Well-organized into distinct sections with the detailed registry correctly delegated to /SECURITY.md as a one-level-deep, clearly signaled reference; at ~90 lines with all process content inline and only a single external pointer, it falls just short of the multi-reference navigation clarity of a 5.	4 / 5
	Total	17 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that clearly states both capability and trigger conditions for a well-scoped niche. The only slight gap is trigger-term breadth, which is bounded by the domain itself having few synonyms.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — handling boundaries, encountering a GRIDA-SEC tag, modifying tagged files, adding a prevented-vulnerability record, mandating a pre-commit security review, and registering a new id — giving comprehensive coverage rather than just naming the domain.	5 / 5
Completeness	It explicitly answers what ('explains the contract, mandates a security review... shows how to register a new id') and when ('Triggers when you encounter a GRIDA-SEC tag...', 'Use whenever GRIDA-SEC appears in context') with concrete trigger phrases.	5 / 5
Trigger Term Quality	The trigger 'GRIDA-SEC' is repeated in natural phrasings ('encounter a GRIDA-SEC tag', 'GRIDA-SEC appears in context', 'modifying files under any tagged path'), giving good keyword coverage; it stops short of the synonyms/extensions breadth of a 5, but this proprietary tag has little synonym surface.	4 / 5
Distinctiveness Conflict Risk	It carves a clear niche — the GRIDA-SEC convention in the Grida repo — with distinct proprietary triggers and minimal risk of matching an unrelated skill.	5 / 5
	Total	19 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: gridaco/grida
Path: .agents/skills/security/SKILL.md
Commit: 8ef5e53

Reviewed: about 11 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.