performing-security-audits

Analyze code, infrastructure, and configurations by conducting comprehensive security audits. It leverages tools within the security-pro-pack plugin, including vulnerability scanning, compliance checking, and cryptography review. Use when assessing security or running audits. Trigger with phrases like 'security scan', 'audit', or 'vulnerability'.

Quality

71%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./plugins/packages/security-pro-pack/skills/performing-security-audits/SKILL.md

Quality

Content

50%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is well-structured but generic: it relies on templated filler, gives no executable guidance, omits validation checkpoints for risky audit operations, and never connects to the bundled templates and script that actually exist. Tightening the boilerplate and wiring in the real bundle files would lift every dimension.

Suggestions

Replace the generic 'Instructions', 'Output', 'Prerequisites', and 'Resources' filler with concrete guidance, and link the actual bundle files (e.g. 'See assets/security_scan_report_template.md for report structure', 'Run scripts/security_scan.py <target>').

Add validation checkpoints to the audit workflow (e.g. confirm scope before scanning, verify findings against the template before reporting) so workflow_clarity can score 3 for these risky/batch operations.

Fix the scripts README to match the real bundle (it lists security_scan.sh/compliance_check.py/crypto_audit.py/infrastructure_scan.sh, none of which exist; only security_scan.py is present).

Dimension	Reasoning	Score
Conciseness	Mostly readable but padded with templated filler sections ('Overview', 'Integration', 'Prerequisites', 'Instructions', 'Output', 'Resources') that restate the description or state what Claude already knows; not 3 because several sections earn few tokens, not 1 because the content is accurate rather than concept-explaining.	2 / 3
Actionability	It names specific agents to invoke ('Security Auditor Expert', 'Compliance Checker') but provides no executable code or commands, and never references the bundled security_scan.py script; not 1 because it does point at concrete tools, not 3 because nothing is copy-paste ready or executable.	2 / 3
Workflow Clarity	'How It Works' gives a 3-step sequence (Analysis Selection, Execution, Reporting) but has no validation checkpoints, and security audits are batch/risky operations the rubric says should cap at 2 without validation; not 3 because checkpoints are absent, not 1 because a real sequence exists.	2 / 3
Progressive Disclosure	Real bundle files exist (assets templates, scripts/security_scan.py) but the body never links to or signals any of them, and the scripts README lists files that do not exist; not 3 because references are not clearly signaled from the body, not 1 because the body is sectioned rather than a monolithic wall.	2 / 3
	Total	8 / 12 Passed

Description

92%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is strong: it states concrete capabilities, gives explicit natural-language triggers, and clearly answers both what and when. Its only weakness is a somewhat broad 'assessing security' framing that could overlap with general code-review skills.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions ('vulnerability scanning, compliance checking, and cryptography review' plus 'Analyze code, infrastructure, and configurations'), matching the anchor for several specific actions; not 2 because it goes beyond naming a domain plus partial actions.	3 / 3
Completeness	Explicitly answers both what (the audit actions) and when ('Use when assessing security or running audits' plus trigger phrases), matching the anchor for clear what-and-when with explicit triggers.	3 / 3
Trigger Term Quality	Includes natural phrases a user would say — 'security scan', 'audit', 'vulnerability' — giving good coverage of common variations, matching the top anchor.	3 / 3
Distinctiveness Conflict Risk	Triggers like 'audit' and 'vulnerability' are fairly distinct, but the broad 'assessing security' framing could overlap with general code-analysis or review skills; not 3 because the niche is not sharply bounded, not 1 because it is more specific than 'helps with code and documents'.	2 / 3
	Total	11 / 12 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
allowed_tools_field	'allowed-tools' contains unusual tool name(s)	Warning
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	14 / 16 Passed

Repository: jeremylongshore/claude-code-plugins-plus-skills
Path: plugins/packages/security-pro-pack/skills/performing-security-audits/SKILL.md
Commit: bddba3c

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.