security-review

Security audit for code changes and PRs — OWASP top 10, auth flows, data handling, secrets exposure, supply chain risks. Writes findings as actionable items.

Quality

85%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

87%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is concise, actionable, and well-organized with a clear output contract, but the review workflow lacks explicit validation/re-check checkpoints after auto-fixes, which caps workflow clarity at 2.

Suggestions

Add an explicit review loop, e.g. after auto-fixing, re-run the affected category check to confirm the issue is resolved before reporting it as fixed.

Sequence the methodology into ordered phases (e.g. ingest diff -> scan by category -> classify severity -> fix-first or escalate) with a checkpoint confirming all categories were covered before producing the health score.

Dimension	Reasoning	Score
Conciseness	Lean bullet lists assume Claude's competence ("no ECB mode", "Look for .unwrap() on user input") with no padding or explanation of basics, matching the 'every token earns its place' anchor.	3 / 3
Actionability	Concrete checks and specifics ("parameterized queries", "httpOnly, secure flags", "AES-256-GCM or ChaCha20-Poly1305"), a complete output template, and concrete tracking paths make the guidance copy-paste actionable; absence of code is fine for this instruction-style audit skill.	3 / 3
Workflow Clarity	The methodology is a category walkthrough rather than a sequenced process, and the auto-fix (mutating) flow lacks explicit validate-then-recheck feedback loops; per the rubric, missing validation checkpoints in batch/destructive operations caps this at 2.	2 / 3
Progressive Disclosure	A single well-organized SKILL.md with clearly labeled sections (When to run, methodology, output format, fix-first, tracking, FP management) and no nested references, which the rubric allows to score 3 for skills needing no external files.	3 / 3
	Total	11 / 12 Passed

Description

82%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, distinctive, and uses natural trigger terms, but it omits an explicit 'when to use' clause, leaving the completeness dimension at the capped level of 2.

Suggestions

Add an explicit 'Use when...' clause, e.g. 'Use when reviewing PRs for security issues, checking code for vulnerabilities, or auditing auth/crypto handling.'

Add a couple of plain-user phrasings like 'is this code secure/safe' to broaden trigger coverage beyond OWASP/CVE-style jargon.

Dimension	Reasoning	Score
Specificity	Lists several concrete audit domains ("auth flows, data handling, secrets exposure, supply chain risks") and a concrete output action ("Writes findings as actionable items"), matching the 'multiple specific concrete actions' anchor.	3 / 3
Completeness	Clearly states what the skill does but lacks any explicit 'Use when...' trigger guidance, which per the rubric caps completeness at 2.	2 / 3
Trigger Term Quality	Includes natural terms a user would say ("security audit", "OWASP top 10", "secrets exposure", "supply chain risks") with good coverage of common phrasings; not reduced to 2 since these are terms users actually invoke.	3 / 3
Distinctiveness Conflict Risk	Scoped clearly to security audits with distinct triggers, unlikely to fire for non-security skills, matching the 'clear niche with distinct triggers' anchor.	3 / 3
	Total	11 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: nearai/ironclaw
Path: skills/security-review/SKILL.md
Commit: 800b781

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.