Name: nowsecure
Rating: 40.8 (1 reviews)
Author: membranedev

nowsecure

NowSecure integration. Manage data, records, and automate workflows. Use when the user wants to interact with NowSecure data.

Quality

40%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/nowsecure/SKILL.md

Quality

Content

38%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The skill's CLI workflow is genuinely actionable and covers the key connection-to-action flow, but it is dragged down by a massive inlined glossary of generic security/compliance terms Claude already knows, no validation steps for destructive operations, and no progressive disclosure structure. Removing the glossary and adding verification checkpoints would substantially improve it.

Suggestions

Delete the entity and security/compliance glossary (lines 23-165); at most keep the handful of NowSecure-specific objects (Assessment, Finding, Workspace, Report) the agent actually operates on.

Add an explicit validation/verification checkpoint before running or proxying actions, especially for destructive calls (e.g. confirm non-GET requests, check the output error field before proceeding).

Split any retained reference material into a one-level-deep reference file (e.g. references/objects.md) linked from the overview, rather than inlining it in SKILL.md.

Dimension	Reasoning	Score
Conciseness	The ~140-line bullet list (lines 23-165) explaining generic security, cryptography, and compliance concepts Claude already knows (SAST, DAST, GDPR, HIPAA, Zero Trust, Kubernetes, 5G, Quantum, etc.) is heavy padding that earns no value against the token budget.	1 / 5
Actionability	It provides concrete, executable CLI commands throughout — install, login, connection ensure, action list/run, and the proxy request flow with a clear flag table — with only minor gaps such as placeholder CONNECTION_ID and <actionId> values.	4 / 5
Workflow Clarity	The connection flow has a real sequence with explicit state handling (READY/BUILDING/CLIENT_ACTION_REQUIRED/CONFIGURATION_ERROR), but there are no validation or verification checkpoints before running actions, and batch/destructive proxy requests (e.g. DELETE) lack feedback loops, capping this dimension at 3.	3 / 5
Progressive Disclosure	There are no bundle files and the body is a single monolithic document; the large inlined glossary is content that should not be present at all, leaving only minimal effective structure despite the section headers.	2 / 5
	Total	10 / 20 Passed

Description

41%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description correctly identifies the NowSecure niche and includes an explicit 'Use when' trigger, but its capability language is vague and its trigger terms are limited to the product name with no natural synonyms. Tightening the action verbs and adding concrete user-facing triggers would lift it notably.

Suggestions

Replace 'Manage data, records, and automate workflows' with concrete NowSecure capabilities such as 'run mobile app security assessments, retrieve findings, and manage remediation workflows'.

Expand the trigger clause with natural phrases users say, e.g. 'Use when the user wants to pull NowSecure findings, view assessment reports, or automate vulnerability remediation workflows'.

Add at least one domain-specific keyword beyond the product name (e.g. 'findings', 'mobile app security', 'assessments') to improve trigger-term quality and distinctiveness.

Dimension	Reasoning	Score
Specificity	The description names the NowSecure domain but its actions are minimal and generic — 'Manage data, records, and automate workflows' uses abstract objects and verbs rather than concrete capabilities.	2 / 5
Completeness	It has both a 'what' ('Manage data, records, and automate workflows') and an explicit 'when' ('Use when the user wants to interact with NowSecure data'), but the 'what' is vague and the 'when' is generic, sitting just below the both-clear-and-specific bar.	3 / 5
Trigger Term Quality	Only the product name 'NowSecure' appears as a keyword; it lacks the natural phrases a user would say (e.g. 'mobile app security testing', 'findings', 'vulnerabilities') and any synonyms.	2 / 5
Distinctiveness Conflict Risk	Naming the 'NowSecure' product gives it a clear, distinct niche with low conflict risk, though the generic 'manage data, records, automate workflows' phrasing leaves minor overlap with broad data-management skills.	4 / 5
	Total	11 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: membranedev/application-skills
Path: skills/nowsecure/SKILL.md
Commit: f484c82

Reviewed: 5 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.