Content
86%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A lean, high-density procedural skill: every step is a concrete rule and the exit criteria define a measurable pass condition. The minor gaps are an underspecified helper contract (no signature or exact 404 behavior shown), no explicit fix-and-revalidate loop when the ownership matrix fails, and a step-6 dependency on another skill's sweep without a fallback.
Suggestions
Add one line after step 5 defining the failure loop: when a matrix cell fails, fix the helper/query and re-run the full matrix — a pass on the fixed cell alone is not sufficient.
Show the `requireOwner`/`ownAudit` contract in one code line (function signature plus the exact 404 return) so the helper's behavior is unambiguous across all routes.
In step 6, name the concrete entry point of the `fix-security-hotfix` sweep and log review, or inline a minimal fallback in case that skill is not available.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | 19 dense lines with zero padding: every step adds project-specific rules ("Scope every collection query by owner or tenant inside the query, not after") and nothing Claude already knows is re-explained. The brief "Each was a cheat our Done-Gate caught" earns its place as a known-failure-mode signal; not 4 because there is nothing to trim without losing guidance. | 5 / 5 |
Actionability | Concrete throughout — named helpers ("requireOwner / ownAudit"), exact cookie flags ("HttpOnly; SameSite=Lax; Secure"), and a specific test matrix ("both directions (A→B, B→A), signed-out access, aged records, a real-browser user-agent") — but the helper's contract is only sketched ("missing or not owned → 404") and step 6 defers to the `fix-security-hotfix` skill's sweep without stating what to run. Not 5 because guidance isn't fully copy-paste ready; not 3 because the instructions are executable as written, not pseudocode. | 4 / 5 |
Workflow Clarity | Six numbered steps in a clear order with explicit validation checkpoints (step 5 "Prove both directions..." plus the Exit criteria "ownership matrix (role × object × action) passes"), so the missing-validation cap does not apply. Not 5 because there is no stated recovery loop for what to do when a check fails — error recovery is only implied; not 3 because checkpoints are explicit, not implicit. | 4 / 5 |
Progressive Disclosure | Under 50 lines, single task, no bundle files; well-organized Procedure and Exit criteria sections, and the two cross-skill pointers (`fix-security-hotfix`, `qa-auth-access`) are clearly signaled and one level deep. Matches the simple-skill anchor of well-organized sections with no need for external references. | 5 / 5 |
Total | 18 / 20 Passed |