CtrlK
BlogDocsLog inGet started
Tessl Logo

security

How to handle `GRIDA-SEC-<id>` security boundaries in the Grida repo. Triggers when you encounter a `GRIDA-SEC` tag in source/docs, when modifying files under any tagged path, or when adding a new prevented- vulnerability record. Each `GRIDA-SEC-<id>` identifies a structural trust boundary documented in `/SECURITY.md`. This skill explains the contract, mandates a security review before committing changes to any tagged file, and shows how to register a new id. Use whenever "GRIDA-SEC" appears in context.

80

Quality

100%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

100%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-crafted instruction skill: actionable grep commands, a validation-gated pre-commit workflow, and proper delegation of canonical detail to /SECURITY.md. Conceptual prose is earned because it conveys a novel project convention rather than basics Claude already knows.

DimensionReasoningScore

Conciseness

Lean and assumes Claude's competence; the conceptual exposition (GRIDA-SEC vs CVE, the four-section shape) is project-specific knowledge Claude does not already have, so it earns its tokens rather than padding.

3 / 3

Actionability

Gives concrete executable commands ("grep -rn GRIDA-SEC-<id> .", "grep -rn GRIDA-SEC-<id> --include='*test*' --include='*spec*'") and specific file/section targets, with copy-ready procedural steps rather than vague direction.

3 / 3

Workflow Clarity

The "Mandatory security review before commit" is a clearly sequenced 5-step process with an explicit validation gate ("If you cannot satisfy steps 1–4, do not commit") and test-running checkpoint — a feedback loop appropriate to a destructive security-boundary change.

3 / 3

Progressive Disclosure

No bundle files exist, so the skill is a single well-organized file that delegates the canonical detail to one clearly-signaled one-level reference ("`/SECURITY.md` is the canonical registry"), matching the overview-points-to-detail pattern.

3 / 3

Total

12

/

12

Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, well-scoped description: third-person voice, concrete actions, explicit trigger guidance, and a clear niche that won't conflict with other skills. It states only what the skill does without over-claiming.

DimensionReasoningScore

Specificity

Lists multiple concrete actions: "mandates a security review before committing changes to any tagged file", "shows how to register a new id", and "handle `GRIDA-SEC-<id>` security boundaries" — all specific rather than vague.

3 / 3

Completeness

Answers both what ("explains the contract, mandates a security review... shows how to register a new id") and when via an explicit "Use whenever 'GRIDA-SEC' appears in context" plus enumerated trigger conditions.

3 / 3

Trigger Term Quality

Within its Grida-repo niche it covers the natural terms a contributor would say: "GRIDA-SEC tag", "GRIDA-SEC-<id>", "tagged path", "prevented-vulnerability record", and "SECURITY.md", with several trigger contexts.

3 / 3

Distinctiveness Conflict Risk

Highly specific to the `GRIDA-SEC` convention "in the Grida repo" with a clear distinct trigger, making overlap with other skills unlikely.

3 / 3

Total

12

/

12

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
gridaco/grida
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.