security-review

Security code review for vulnerabilities. Use when asked to "security review", "find vulnerabilities", "check for security issues", "audit security", "OWASP review", or review code for injection, XSS, authentication, authorization, cryptography issues. Provides systematic review with confidence-based reporting.

1.11x

Quality

83%

Does it follow best practices?

Impact

97%

1.11x

Average score across 3 eval scenarios

Securityby

High

Do not use without reviewing

Quality

Content

78%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable and reasonably concise, with a clear confidence-gated review workflow. Its main weakness is progressive disclosure: several referenced reference paths (languages/, infrastructure/) are absent from the bundle, leaving broken navigation.

Suggestions

Create the referenced `languages/` and `infrastructure/` guide files (or remove/rewrite those mapping tables) so every cited reference path resolves to a real bundle file.

Consolidate the 'research before flagging' guidance into one step to remove the near-duplicate content in 'Scope', step 4, and step 5.

Tighten the 'Do Not Flag' / framework-mitigated tables by merging overlapping examples to recover additional token budget.

Dimension	Reasoning	Score
Conciseness	Mostly lean — tables, code blocks, and flag lists assume Claude's framework knowledge — but the 'research before flagging' guidance is restated across 'Scope', step 4, and step 5, which could be tightened. Not a 5 because of that repetition; not a 3 because the bulk is genuinely efficient.	4 / 5
Actionability	Fully actionable: copy-paste 'Always Flag' code patterns, a file-type→reference mapping table, and concrete SAFE/VULNERABLE SSRF and path-traversal pairs cover common cases explicitly.	5 / 5
Workflow Clarity	A clear 6-step 'Review Process' sequence gated by an explicit HIGH/MEDIUM/LOW confidence checkpoint before reporting. Not a 5 because steps 4–6 largely restate 'research first' rather than adding distinct sequenced actions or error-recovery loops.	4 / 5
Progressive Disclosure	The body is well structured with reference tables, but it points to `languages/.md` and `infrastructure/.md` directories that do not exist in the bundle (only `references/` is present), so navigation is partly broken and references are not cleanly one-level-deep as signaled.	3 / 5
	Total	16 / 20 Passed

Description

87%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is strong: it pairs a concrete statement of capability with an explicit, well-populated 'Use when' trigger list and a distinctive security-review niche. Minor gains are possible only by broadening vulnerability-type coverage and adding synonyms.

Dimension	Reasoning	Score
Specificity	Quotes 'injection, XSS, authentication, authorization, cryptography issues' and 'systematic review with confidence-based reporting' — names the security domain plus several concrete review capabilities, with only minor coverage gaps (e.g. no mention of SSRF/deserialization).	4 / 5
Completeness	Clearly answers both 'what' ('Security code review for vulnerabilities...confidence-based reporting') and 'when' via an explicit 'Use when asked to...' clause with concrete trigger phrases.	5 / 5
Trigger Term Quality	Includes natural phrases users say ('security review', 'find vulnerabilities', 'check for security issues', 'audit security', 'OWASP review'); good coverage but a few common synonyms (e.g. 'pen test', 'pentest') are absent.	4 / 5
Distinctiveness Conflict Risk	Has a clear niche (security vulnerability review) with distinct OWASP/exploit triggers; minimal overlap risk with unrelated skills.	5 / 5
	Total	18 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
allowed_tools_field	'allowed-tools' contains unusual tool name(s)	Warning

	Total	15 / 16 Passed

Repository: joe-bell/cva
Path: .agents/skills/security-review/SKILL.md
Commit: b06a7c8

Reviewed: 7 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.