Content
60%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The SKILL.md body is a well-organized, defense-framed index with strong tables and an explicit verification checklist, and it avoids teaching basics Claude already knows. However, the entire bundle behind it is missing — all three referenced module files are absent — leaving the skill as navigation scaffolding with no depth, and the body itself contains no executable commands or configuration examples.
Suggestions
Add the referenced modules/devsecops.md, modules/container.md, and modules/api-ops.md files to the bundle — the body routes all depth to them and they do not exist, which breaks progressive disclosure entirely.
Include at least a few concrete, executable examples in the body (e.g., a trivy/grype image-scan command, a checkov/tfsec IaC scan invocation, a YAML snippet of a least-privilege RBAC policy or hardened pod securityContext) so the skill is actionable even before module loading.
Consolidate the scope-separation material: the 'Distinction from moai-ref-owasp-checklist' section and the Cross-References list largely repeat the description's NOT-for boundaries — one of them can be trimmed.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is table-heavy and assumes domain competence (it never explains what Kubernetes or a WAF is), with every row carrying defensive content. It is not 5 because there is redundancy: the intro framing, the 'Distinction from moai-ref-owasp-checklist' section, and the Cross-References section each restate the same scope separation, and the 'Operational Trust Boundaries' table overlaps the module table's routing. | 4 / 5 |
Actionability | The body gives concrete identification guidance — named controls ("seccomp, AppArmor, read-only root, non-root, drop capabilities"), named misconfigurations ("ServiceAccount bound to cluster-admin"), and a severity-to-action table — but no executable commands, configurations, or tool invocations, and the module files that would carry the depth are absent. This sits between the 2 anchor (high-level hints only) and the 4 anchor (mostly executable guidance). | 3 / 5 |
Workflow Clarity | There is a coherent implicit review flow — threat model, trust-boundary routing to modules, severity assignment, red flags, then an explicit verification checklist with per-module checkpoints — matching the 4 anchor's 'clear sequence with most checkpoints present'. It is not 5 because no explicit step sequence or error-recovery loop for conducting a review is stated; it is not 3 because the verification checklist supplies explicit checkpoints rather than implicit ones. | 4 / 5 |
Progressive Disclosure | As written, the body is an exemplary clear-overview index with well-signaled one-level-deep references ([modules/devsecops.md], [modules/container.md], [modules/api-ops.md]) — but scored against the actual bundle, none of the three referenced module files exist (no modules/, references/, scripts/, or assets/ directories), so every reference is a dead end and the skill's depth is unreachable. Broken references put it noticeably below the midpoint; it is above the 1 anchor only because the overview structure and routing themselves are clear and unnested. | 2 / 5 |
Total | 13 / 20 Passed |