Name: secure-code-warrior
Rating: 51.2 (1 reviews)
Author: membranedev

secure-code-warrior

Secure Code Warrior integration. Manage data, records, and automate workflows. Use when the user wants to interact with Secure Code Warrior data.

Quality

56%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/secure-code-warrior/SKILL.md

Quality

Content

50%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The skill's CLI integration guidance is concrete and executable with a solid connection feedback loop, but it is undermined by a massive inlined, duplicated entity list that bloats the context and a lack of validation checkpoints for action execution. No bundle files are used, so all content lives in one file.

Suggestions

Move the 'Secure Code Warrior Overview' entity list into a separate references file (e.g. references/entities.md) and replace the inline list with a one-line pointer, eliminating ~270 lines of duplicated padding from the main body.

Add an explicit numbered end-to-end workflow (install → login → connection ensure → wait READY → action list → action run) and a validation checkpoint after running or proxying actions (e.g. inspect the `output`/`error` field and retry on failure) to lift workflow clarity above the destructive-operation cap.

Trim the introductory paragraph explaining what Secure Code Warrior is; Claude can infer this, so lead directly with the integration instructions.

Dimension	Reasoning	Score
Conciseness	The ~270-line 'Overview' bullet list of generic, often duplicated nouns (Vulnerability Management, Incident Management, etc. appear repeatedly) is heavy padding that earns no tokens, and the intro re-explains what SCW is, fitting 'noticeably verbose; several unnecessary explanations or padded sections'; it is not score 1 only because the CLI/action half is reasonably tight.	2 / 5
Actionability	The CLI, authentication, connection, action-list/run, and proxy sections give concrete, copy-pasteable bash commands plus a flag table covering common cases, matching 'mostly executable guidance; concrete code or commands with minor gaps'; it stops short of 5 because actual actionIds rely on runtime discovery and no worked end-to-end example is given.	4 / 5
Workflow Clarity	The connection sub-flow has a real feedback loop (poll state, handle CLIENT_ACTION_REQUIRED, re-poll) but there is no overall numbered install→auth→connect→search→run sequence, and running/proxying actions (potentially destructive/batch) lacks output validation, which per the rubric caps workflow clarity at 3.	3 / 5
Progressive Disclosure	There are clear section headers and no bundle files exist, but the huge inlined entity list clearly belongs in a separate reference file, matching 'some structure but could be better organized; content that should be separate is inline'; it avoids score 2 because the rest of the content is sectioned rather than headerless.	3 / 5
	Total	12 / 20 Passed

Description

62%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description correctly identifies a distinct product niche and includes an explicit 'Use when' trigger, giving solid activation guidance. It is held back by generic capability verbs and limited trigger-term variation beyond the product name.

Suggestions

Replace generic verbs ('Manage data, records, and automate workflows') with concrete SCW actions such as listing/running tournaments, courses, learning paths, and assessments so the capability is specific.

Expand the 'when' clause with concrete trigger phrases users would actually say, e.g. 'Use when the user wants to query Secure Code Warrior tournaments, enroll users in courses, or pull training reports.'

Add natural synonyms/variants alongside the product name (e.g. 'Secure Code Warrior (SCW)') to broaden trigger-term coverage.

Dimension	Reasoning	Score
Specificity	It names the domain ("Secure Code Warrior") and lists a few actions ("Manage data, records, and automate workflows"), but those actions are generic rather than concrete SCW-specific operations, matching the 'names domain and 1-2 concrete actions, not comprehensive' anchor rather than the more specific score 4.	3 / 5
Completeness	It states both a 'what' ("Manage data, records, and automate workflows") and an explicit 'when' ("Use when the user wants to interact with Secure Code Warrior data"), but the 'when' is fairly general, matching 'has both what and when; when could be more explicit or specific' rather than the concrete-trigger-phrases anchor at 5.	4 / 5
Trigger Term Quality	The product name "Secure Code Warrior" is the dominant natural trigger and appears twice, but surrounding terms ("data, records, workflows") are generic and lack synonyms/variations, fitting 'some relevant keywords but missing common variations' better than the fuller coverage of score 4.	3 / 5
Distinctiveness Conflict Risk	Naming a specific product ("Secure Code Warrior") gives a clear niche with low conflict risk, but the generic 'manage data, records, automate workflows' phrasing creates minor overlap with general data-management skills, so it sits below the minimal-risk score 5.	4 / 5
	Total	14 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: membranedev/application-skills
Path: skills/secure-code-warrior/SKILL.md
Commit: f484c82

Reviewed: 4 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.