CtrlK
BlogDocsLog inGet started
Tessl Logo

performing-security-code-review

Execute this skill enables AI assistant to conduct a security-focused code review using the security-agent plugin. it analyzes code for potential vulnerabilities like sql injection, xss, authentication flaws, and insecure dependencies. AI assistant uses this skill wh... Use when assessing security or running audits. Trigger with phrases like 'security scan', 'audit', or 'vulnerability'.

67

Quality

82%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

SKILL.md
Quality
Evals
Security

Quality

Content

80%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is concise and actionable with specific patterns and remediation, but the workflow lacks inline validation checkpoints for a batch scanning task, and bundled resources (report template, example code, analyzer script) are not clearly signaled from the body where they would be useful.

Suggestions

Add an explicit validation/verification checkpoint to the workflow — e.g. 'Before reporting, verify each finding against its context and flag likely false positives (test fixtures, docs)' — so the false-positive feedback loop is part of the process, not only the error table.

Link the bundled assets where they are relevant: point to assets/report_template.md in the Output section and to assets/example_code_vulnerable.py / example_code_secure.py in the Examples section, and reference scripts/code_analyzer.py in the scan steps.

Fill the near-empty references/, scripts/, and assets/ README stubs so they act as real navigation indexes rather than placeholder titles with unchecked checklists.

DimensionReasoningScore

Conciseness

The body is lean and assumes competence — each numbered step gives specific patterns (`AKIA...`, `BEGIN PRIVATE KEY`, `eval()`/`exec()`/`Function()`) without padding explanations of what SQL injection or XSS are, so every token earns its place.

3 / 3

Actionability

Concrete search patterns, commands (`npm audit`), and remediation ('use parameterized queries', 'bcrypt, argon2 rather than MD5/SHA1') give specific, actionable guidance; per the scoring notes, absence of inline code is not penalized for an instruction-only skill with actionable guidance.

3 / 3

Workflow Clarity

The seven-step scan sequence is clearly listed, but validation/verification checkpoints are absent from the workflow itself — false-positive handling lives in the error table rather than as an inline verify-before-report step, and the scoring notes cap workflow clarity at 2 for batch operations missing feedback loops.

2 / 3

Progressive Disclosure

Bundle files exist (scripts/code_analyzer.py, assets/report_template.md and example vulnerable/secure code) but the body only signals references/README.md at the end and never links the valuable report template or example code from the Output/Examples sections, fitting the anchor for structure present but references not clearly signaled.

2 / 3

Total

10

/

12

Passed

Description

85%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and complete, covering concrete vulnerability types and an explicit 'Use when' trigger. It is held back by limited trigger-term coverage and by grammatical errors plus a truncated phrase ('AI assistant uses this skill wh...') that reduce clarity without changing the third-person voice.

Suggestions

Expand trigger terms to cover common variations users say, e.g. 'pentest', 'CVE', 'CWE', 'dependency check', 'secret scan', alongside the existing 'security scan', 'audit', 'vulnerability'.

Fix the broken phrasing and truncation — rewrite 'Execute this skill enables AI assistant...' and complete 'AI assistant uses this skill wh...' into clean third-person sentences.

Tighten the opening so the skill's purpose ('Conducts security-focused code reviews...') leads the description instead of the awkward 'Execute this skill enables' construction.

DimensionReasoningScore

Specificity

Names multiple concrete actions and vulnerability types — "conduct a security-focused code review", "analyzes code for potential vulnerabilities like sql injection, xss, authentication flaws, and insecure dependencies" — matching the anchor for listing several specific concrete actions rather than just naming a domain.

3 / 3

Completeness

Explicitly answers both what ("conduct a security-focused code review... analyzes code for potential vulnerabilities") and when ("Use when assessing security or running audits"), and the required 'Use when...' trigger clause is present so it is not capped at 2.

3 / 3

Trigger Term Quality

Provides a few natural terms a user would say ("security scan", "audit", "vulnerability") but coverage is thin and omits common variations like pentest, CVE, CWE, or dependency check, fitting the anchor for some relevant keywords missing common variations.

2 / 3

Distinctiveness Conflict Risk

Security-focused code review is a clear niche with distinct triggers ("security scan", "audit", "vulnerability") unlikely to fire for unrelated skills.

3 / 3

Total

11

/

12

Passed

Validation

87%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation14 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

allowed_tools_field

'allowed-tools' contains unusual tool name(s)

Warning

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

14

/

16

Passed

Repository
jeremylongshore/claude-code-plugins-plus-skills
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.