clawsec-feed

Security advisory feed package for OpenClaw-related threats and vulnerabilities. The upstream feed is updated daily; local automation is handled by clawsec-suite or the operator.

Quality

63%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/clawsec-feed/SKILL.md

Quality

Content

77%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with excellent validation-gated deployment workflows, but it pays for that in length and repetition and keeps everything inline in one ~850-line file with no bundle-level progressive disclosure. Actionability and workflow clarity are strong; conciseness and progressive disclosure are mid-level.

Suggestions

Factor the repeated feed-fetch boilerplate (DEFAULT_FEED_URL, curl --retry, temp-file + jq-empty validation) into a single reusable snippet or a scripts/ helper to remove triplicated content.

Move the long release-artifact verification and individual-file-fallback install scripts into a references/ or scripts/ file referenced one level deep, keeping SKILL.md as an overview + quick-start.

Consolidate the duplicate integrity/bootstrapping discussion ("Release Artifact Verification" vs "Initial Download Integrity") into one section to cut redundant tokens.

Dimension	Reasoning	Score
Conciseness	The body is mostly actionable code rather than concept explanation, but it is ~850 lines with significant repetition (the DEFAULT_FEED_URL / curl-retry / temp-feed boilerplate recurs across at least three sections), so it could be tightened considerably; not yet lean enough for a 3.	2 / 3
Actionability	Provides fully executable, copy-paste-ready bash and jq (e.g. the checksum-verification block, "jq '.advisories[] \| select(.severity == \"critical\")'", the cross-reference scan) with specific commands and concrete examples throughout.	3 / 3
Workflow Clarity	The Deploy workflow is explicitly sequenced (Step 1-4) with strong validation checkpoints - checksum verification, JSON-structure validation, path-traversal and zip-bomb checks, and "Only install or extract the archive after this verification succeeds" - plus error-recovery fallbacks, matching the clear-sequence-with-validation anchor.	3 / 3
Progressive Disclosure	Sections are organized with clear headers, but the skill is a monolithic single file with no bundle files (references/scripts/assets absent) and content that could be split (the long install/verification script, the exploitability-prioritization guide) is inline; the only references point outside the bundle to ../../wiki and ../clawsec-suite, fitting the 'some structure, content that should be separate is inline' anchor.	2 / 3
	Total	10 / 12 Passed

Description

50%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description identifies a clear niche and uses appropriate third-person voice, but it reads as package metadata rather than invocation guidance: it lacks explicit "Use when..." triggers, concrete actions, and natural trigger terms. This places every dimension at the mid-level anchor.

Suggestions

Add an explicit trigger clause, e.g. "Use when monitoring for security advisories, checking installed skills for known vulnerabilities, or when the user asks about threats to OpenClaw skills."

Replace package-description framing with concrete actions ("Monitors the advisory feed, cross-references installed skills, and alerts on critical/high-exploitability threats").

Surface natural user-facing keywords ("security alerts", "vulnerable skills", "CVE check") so the skill triggers on the phrases users actually say.

Dimension	Reasoning	Score
Specificity	Names a concrete domain ("Security advisory feed package for OpenClaw-related threats and vulnerabilities") but describes what the package IS rather than listing concrete actions a user would invoke, so it stops at naming domain + some actions.	2 / 3
Completeness	It states what the package is, but there is no "Use when..." clause or equivalent explicit trigger for when Claude should invoke it, which per the guidelines caps completeness at 2.	2 / 3
Trigger Term Quality	Includes some natural terms a user might say ("security advisory feed", "threats and vulnerabilities") but leans technical ("OpenClaw-related", "upstream feed", "local automation") and lacks common user variations, missing full coverage.	2 / 3
Distinctiveness Conflict Risk	The OpenClaw security-advisory niche is fairly distinct, but it explicitly defers automation to clawsec-suite, creating overlap/conflict risk with that sibling skill and lacking distinct explicit triggers.	2 / 3
	Total	8 / 12 Passed

Validation

68%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 11 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (864 lines); consider splitting into references/ and linking	Warning
metadata_version	'metadata.version' is missing	Warning
metadata_field	'metadata' should map string keys to string values	Warning
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning
relative_links	Relative link issues: 2 suspicious	Warning

	Total	11 / 16 Passed

Repository: prompt-security/clawsec
Path: skills/clawsec-feed/SKILL.md
Commit: c6194eb

Reviewed: 14 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.