security-diff-scan

Use when the user asks for a security review of a pull request, commit, branch diff, working-tree patch, or other Git-backed change set.

Quality

83%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

High

Do not use without reviewing

Quality

Content

77%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with concrete commands, explicit phase sequencing, and strong validation checkpoints. It loses points for repeated redundancy across sections and because the referenced bundle files are not present in the skill to confirm a clean one-level-deep reference structure.

Suggestions

Deduplicate the app-setup routing, preflight remediation, and 'do not fail automatically' rules into a single source and reference it once, rather than restating them across Setup Workspace Routing, Capability Preflight, Goal Setup, and Hard Rules.

Ensure the referenced files (config-preflight.md, scan-artifacts.md, final-report.md, shared-hard-rules.md) are bundled so the one-level-deep progressive disclosure structure is verifiable and navigable.

Consolidate the repeated coverage-closure / work_ledger receipt criteria so the closure condition appears in one place rather than across Goal Setup, Execution Plan, and Hard Rules.

Dimension	Reasoning	Score
Conciseness	The body is mostly efficient and task-focused, but several sections restate the same routing/recovery rules repeatedly (e.g., the app-setup fallback, preflight remediation, and "do not fail automatically" caveats appear across "Setup Workspace Routing", "Capability Preflight", "Goal Setup", and "Hard Rules"), adding redundancy that could be tightened.	2 / 3
Actionability	It provides concrete, copy-paste-ready commands (e.g., the generate_rank_input.py invocations with exact flags, finalize_scan_contract.py invocation, exact artifact paths and tool names like open_codex_security_workspace), plus specific ledger/receipt contracts, so guidance is fully executable rather than abstract.	3 / 3
Workflow Clarity	It defines a clear linear phase sequence with explicit ordering rules ("Do not read ahead...", "Do not skip ahead"), validation checkpoints (preflight ready/blocked/incomplete handling, ledger receipts gating phase transitions), and explicit error-recovery feedback loops for the destructive fail/decline-remediation paths.	3 / 3
Progressive Disclosure	It signals one-level-deep references to external files (config-preflight.md, scan-artifacts.md, final-report.md, shared-hard-rules.md), but none of those bundle files are present in the skill directory, so the structure cannot be verified as properly split and navigable beyond the in-skill pointers, leaving it at the "some structure but could be better organized" anchor.	2 / 3
	Total	10 / 12 Passed

Description

90%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is concise, uses an explicit natural "Use when..." trigger, and clearly states both what it does and when to invoke it. The only gap is that it names a single action (security review) rather than enumerating multiple concrete capabilities, keeping specificity just below top.

Dimension	Reasoning	Score
Specificity	It names the domain (security review of a Git-backed change set) and enumerates concrete change-set types ("pull request, commit, branch diff, working-tree patch"), but describes only one action ("security review") rather than multiple distinct concrete actions, so it does not reach the multi-action anchor.	2 / 3
Completeness	It explicitly answers both: what (security review of a change set) and when ("Use when the user asks for a security review of a pull request, commit, branch diff, working-tree patch, or other Git-backed change set"), matching the explicit-trigger anchor.	3 / 3
Trigger Term Quality	It leads with a natural "Use when the user asks for a security review..." phrasing and covers the common variations users would actually say — "security review", "pull request", "commit", "branch diff", "working-tree patch" — giving good coverage of natural trigger terms.	3 / 3
Distinctiveness Conflict Risk	The Git-backed change-set framing and specific diff targets carve a clear niche unlikely to trigger for non-security or non-diff skills, matching the clear-niche anchor.	3 / 3
	Total	11 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: openai/plugins
Path: plugins/codex-security/skills/security-diff-scan/SKILL.md
Commit: 11c74d6

Reviewed: 17 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.