aif-security-checklist

Security audit checklist based on OWASP Top 10 and best practices. Covers authentication, injection, XSS, CSRF, secrets management, and more. Use when reviewing security, before deploy, asking "is this secure", "security check", "vulnerability".

Quality

76%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/aif-security-checklist/SKILL.md

Quality

Content

68%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable body with concrete code and audit commands and well-signaled external references, weakened mainly by verbose config/lifecycle prose and a lack of validation checkpoints around the destructive git-history cleanup workflow.

Suggestions

Add an explicit validation/verification step (e.g., verify history is clean, confirm with the team, rotate secrets) and rollback guidance to the Git History Cleanup section so the destructive force-push workflow has a checkpoint.

Tighten the Config and Ignored Items language-resolving prose into a compact resolved-values table; the repeated explanations of ui_language/artifact_language/technical_terms_policy are the main source of verbosity.

Move the Severity Reference table and the full aif-gate-result schema/example into a reference file (e.g. references/GATE-RESULT.md) and link to it from the body to improve progressive disclosure.

Dimension	Reasoning	Score
Conciseness	Checklists and code blocks are tight, but the config/language-resolving prose (resolving paths.ui_language, artifact_language, technical_terms_policy) and the SECURITY.md format plus output-example sections are noticeably verbose and somewhat redundant.	3 / 5
Actionability	Provides fully executable code (parameterized queries, XSS encoding, CSP header string, zod validation, error normalization), concrete grep audit commands, and a runnable audit.sh script covering common cases copy-paste ready.	5 / 5
Workflow Clarity	The ignore flow and gate status mapping are sequenced, but the destructive git-history cleanup (git filter-branch / BFG with force-push) lacks validation or rollback checkpoints, so the destructive/batch-operation cap applies.	3 / 5
Progressive Disclosure	Body clearly signals three real one-level-deep references (AUTH-PATTERNS.md, RACE-CONDITIONS.md, PROMPT-INJECTION.md) and audit.sh, but a large amount of reference-worthy material (severity table, gate schema, full checklists) remains inlined.	4 / 5
	Total	15 / 20 Passed

Description

83%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description that clearly states the skill's purpose and gives concrete, natural trigger phrases for when to use it. It is mostly specific and distinct, with only minor coverage gaps ('and more') and a few missing trigger synonyms.

Dimension	Reasoning	Score
Specificity	Names the security domain and enumerates several concrete coverage areas ('authentication, injection, XSS, CSRF, secrets management, and more'), but describes coverage rather than distinct concrete actions, with the 'and more' leaving a minor gap.	4 / 5
Completeness	Explicitly answers both what ('Security audit checklist based on OWASP Top 10 and best practices. Covers ...') and when ('Use when reviewing security, before deploy, asking "is this secure", "security check", "vulnerability"') with concrete trigger phrases.	5 / 5
Trigger Term Quality	Includes natural user phrasing such as 'is this secure', 'security check', 'vulnerability', plus 'reviewing security' and 'before deploy'; good coverage with a few synonyms missing.	4 / 5
Distinctiveness Conflict Risk	Has a clear niche (OWASP-based security audit checklist) with distinct trigger phrasing; minor overlap risk with other generic security tooling but largely distinguishable.	4 / 5
	Total	17 / 20 Passed

Validation

81%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 13 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (610 lines); consider splitting into references/ and linking	Warning
allowed_tools_field	'allowed-tools' contains unusual tool name(s)	Warning
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	13 / 16 Passed

Repository: lee-to/ai-factory
Path: skills/aif-security-checklist/SKILL.md
Commit: e144f95

Reviewed: 5 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.