Content
88%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A strong, highly actionable instruction-only skill: concrete git/gh/npm commands, an explicit five-phase workflow with stop conditions, and a complete output template. The only weaknesses are minor duplicated emphasis of the safety rules and a monolithic layout template that could be split out.
Suggestions
State the never-publish/human-review boundary once (e.g., in Hard rules only) and let the intro reference it in a few words, removing the duplicated sentences about publishing and verification.
Move the ~50-line advisory body layout template into a references/ file (e.g. references/advisory-template.md) and point to it from Phase 5, keeping SKILL.md as a lean overview.
Merge the 'grounded in the actual code, not just the reporter's claims' guidance in the Process preamble with the equivalent Hard rules bullet to eliminate the remaining redundancy.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is dense and assumes Claude's competence (no explanations of what CVSS or a GHSA is), but the never-publish/human-review rule is stated in both the intro and Hard rules, and the verify-don't-copy point appears in both the Process preamble and Hard rules — minor duplication that could be trimmed, so below the 'every token earns its place' anchor. | 4 / 5 |
Actionability | Fully executable guidance throughout: copy-paste commands with placeholders (`git log -S '<code fragment>'`, `git tag --contains <sha> | sort -V | head`, `npm view <pkg> versions --json`, `gh api /repos/nrwl/nx/security-advisories/<GHSA-ID>`), an exact output path, and a complete advisory layout template that covers the common case end to end. | 5 / 5 |
Workflow Clarity | Five phases explicitly sequenced with a 'do not skip the investigation phases' directive and explicit validation checkpoints: stop-and-report if the flaw cannot be confirmed, npm verification that patched versions are published, and a closing recap for reviewer sanity-check. This matches the clear-sequence-with-explicit-validation anchor; the destructive/batch cap does not apply since output is a local draft only. | 5 / 5 |
Progressive Disclosure | A single well-organized ~145-line file with clear section headers, no buried references, and no bundle files to navigate — good structure with everything appropriately placed. It falls short of the level-5 anchor only because it exceeds the under-50-line simple-skill case, and the ~50-line advisory layout template is content that could live in a references/ file as the skill grows. | 4 / 5 |
Total | 18 / 20 Passed |