brakeman

Static analysis security vulnerability scanner for Ruby on Rails applications. Use when analyzing Rails code for security issues, running security audits, reviewing code for vulnerabilities, setting up security scanning in CI/CD, managing security warnings, or investigating specific vulnerability types (SQL injection, XSS, command injection, etc.). Also use when configuring Brakeman, reducing false positives, or integrating with automated workflows.

Quality

87%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

75%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A thorough, highly actionable Brakeman guide with clear workflows and well-signaled references, somewhat held back by redundancy between its workflow, best-practices, and usage sections.

Suggestions

Consolidate Common Workflows and Best Practices into the existing Usage/Advanced sections to remove redundancy and cut tokens.

Reference scripts/brakeman_helper.rb in the body so the bundled helper is discoverable, or note its purpose in the Resources section.

Move the full interactive-ignore key list and detailed confidence-level prose into references and keep only the essential flags inline.

Dimension	Reasoning	Score
Conciseness	Mostly efficient with concrete commands, but the Common Workflows and 10-item Best Practices sections restate guidance already covered, and the interactive-ignore key list and Troubleshooting add padding that could be tightened.	3 / 5
Actionability	Abundant copy-paste-ready bash commands and YAML/CI examples cover installation, scanning, filtering, interactive ignore, comparison, configuration, and CI integration across the common cases.	5 / 5
Workflow Clarity	A decision tree and numbered Common Workflows sequence the process, with a CI exit-code check providing a validation checkpoint, but most validation steps remain implicit rather than explicit validate-fix-retry loops.	4 / 5
Progressive Disclosure	Three reference files are clearly signaled one level deep with a Resources section, but the body inlines material that could live in references and the bundled scripts/brakeman_helper.rb is never referenced.	4 / 5
	Total	16 / 20 Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that crisply states the skill's purpose and gives explicit, varied trigger phrases covering scanning, configuration, and false-positive workflows.

Dimension	Reasoning	Score
Specificity	Names the Rails security domain and lists many concrete actions (audits, CI/CD scanning, managing warnings, investigating named vulnerability types, configuring Brakeman, reducing false positives), matching the comprehensive-coverage anchor.	5 / 5
Completeness	Clearly states what it does ('Static analysis security vulnerability scanner for Ruby on Rails') and gives explicit enumerated 'Use when...' triggers for both scanning and configuration scenarios.	5 / 5
Trigger Term Quality	Covers natural user phrasings ('security audits', 'reviewing code for vulnerabilities', 'security scanning in CI/CD') plus synonyms and specific terms (SQL injection, XSS, command injection), fitting the comprehensive-synonyms anchor.	5 / 5
Distinctiveness Conflict Risk	The Ruby on Rails static security scanning niche is distinct with specific triggers, creating minimal overlap risk with non-Rails skills.	5 / 5
	Total	20 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: lucianghinda/superpowers-ruby
Path: skills/brakeman/SKILL.md
Commit: 99fac3d

Reviewed: 7 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.