security-review

Security audit for code changes and PRs — OWASP top 10, auth flows, data handling, secrets exposure, supply chain risks. Writes findings as actionable items.

Quality

67%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/security-review/SKILL.md

Quality

Content

68%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a lean, actionable security checklist with concrete patterns and a clear output template, assuming Claude's competence throughout. Its main weakness is workflow clarity: auto-fixing code and batch-writing findings/commitments proceed without an explicit validation or verification checkpoint, capping that dimension at 3.

Suggestions

Add an explicit validation checkpoint in the Fix-first model (e.g., after auto-fixing, re-run the relevant tests/linter and only mark [AUTO-FIXED] when they pass) to lift workflow_clarity above the batch/destructive cap.

Provide one fully worked example finding (filled title, location, risk, fix, auto-fixed) and a concrete grep command for secrets so the guidance is copy-paste ready.

Add a brief verification step before writing tracking files (confirm the finding is not already in calibration.md as a known false positive) to close the batch-write validation gap.

Dimension	Reasoning	Score
Conciseness	Lean bullet checklists that assume Claude's competence (no explaining what TLS, OWASP, or ECB mode is), with only minor editorializing ("Be thorough but practical — flag real risks, not theoretical ones") that could be trimmed.	4 / 5
Actionability	Concrete named patterns to hunt (".unwrap() on user input", "Math.random()", "ECB mode", "AES-256-GCM"), a filled output template, and exact tracking paths, but no worked example finding or actual grep commands leave minor gaps versus the copy-paste-ready 5 anchor.	4 / 5
Workflow Clarity	Categories are sequenced (1–6) with a Health Score and "No issues found in" completeness signal, but there is no explicit validation checkpoint before auto-fixing code or batch-writing findings/commitments; the destructive/batch cap at 3 applies.	3 / 5
Progressive Disclosure	A single well-organized file with clear section headers and no nested references; content is appropriately placed for a self-contained skill, but it is not the overview-pointing-to-one-level-references pattern of the 5 anchor.	4 / 5
	Total	15 / 20 Passed

Description

66%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and well-targeted to the security domain with strong natural trigger terms, but it omits an explicit "Use when..." clause, leaving the activation condition only weakly implied and capping completeness at 3. Specificity and distinctiveness are solid but stop just short of the top anchors.

Suggestions

Add an explicit 'Use when...' clause naming concrete trigger phrases (e.g., 'Use when reviewing PRs for vulnerabilities, or when the user mentions OWASP, injection, XSS, or secrets exposure').

Include natural synonyms users say ("vulnerability", "injection", "XSS", "penetration") alongside "OWASP top 10" to lift trigger-term coverage to 5.

Lead with concrete action verbs ("Audits", "Traces", "Flags", "Auto-fixes") instead of a single "audit" verb followed by a scope list to push specificity toward 5.

Dimension	Reasoning	Score
Specificity	Lists several concrete scope areas ("OWASP top 10, auth flows, data handling, secrets exposure, supply chain risks") plus a concrete output action ("Writes findings as actionable items"), but the framing is one verb (audit) plus a domain list rather than the multiple discrete verbs of the 5 anchor.	4 / 5
Completeness	A clear "what" is present (security audit scope + writes findings) but there is no explicit "Use when..." clause; "when" is only weakly implied via "code changes and PRs", so completeness is capped at 3 per the rubric guideline.	3 / 5
Trigger Term Quality	Good natural keyword coverage ("security audit", "OWASP", "PRs", "secrets exposure", "supply chain") that users would actually say, but common variations like "vulnerability", "injection", and "XSS" are absent.	4 / 5
Distinctiveness Conflict Risk	A clear security niche with distinct triggers (OWASP, secrets, supply chain) and minimal conflict risk, with only minor overlap risk against a general code-review skill.	4 / 5
	Total	15 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: nearai/ironclaw
Path: skills/security-review/SKILL.md
Commit: 9102166

Reviewed: ~15 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.