clawsec-nanoclaw

Use when checking for security vulnerabilities in NanoClaw skills, before installing new skills, or when asked about security advisories affecting the bot

Quality

83%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

77%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

Highly actionable content with strong validation-gated workflows for install and release verification. Its main weaknesses are verbosity (redundant common-mistakes patterns, a marketing impact section, and an oversized inline verification script) and progressive disclosure that points to non-existent bundle files while keeping reference-grade material inline.

Suggestions

Collapse the three 'Common Mistakes' entries into one, since two of them repeat the same exploitability+severity DO pattern.

Move the long Release Artifact Verification bash script and the full MCP tool reference into separate reference files (e.g. references/verify-release.md, references/tools.md) and create the referenced INSTALL.md and docs/ so the one-level-deep links resolve.

Trim the marketing-toned 'Real-World Impact' section (e.g. 'Zero false positives') to factual statements or remove it.

Dimension	Reasoning	Score
Conciseness	The body is mostly concrete and does not explain concepts Claude already knows, but it is padded: the three 'Common Mistakes' entries repeat the same exploitability+severity logic, the 'Real-World Impact' section is marketing fluff ('Zero false positives'), and a ~70-line release-verification bash script is inlined where a reference would do, matching 'mostly efficient but could be tightened'.	2 / 3
Actionability	Concrete TypeScript call examples with real tool names and parameters, a full quick-reference table mapping tasks to tools, and a copy-paste-ready bash verification script provide fully executable guidance.	3 / 3
Workflow Clarity	Risky operations have explicit validation checkpoints: the install pattern checks safety then gates on user confirmation, and the release verification uses set -euo pipefail with fingerprint/signature/checksum checks before 'Only install ... after this verification succeeds', matching the clear-sequence-with-validation anchor.	3 / 3
Progressive Disclosure	Sections are organized and reference INSTALL.md and docs/ with clear one-level signaling, but no bundle files actually exist and the ~280-line body keeps the full tool catalog and long verification script inline rather than splitting them out, matching 'some structure but content that should be separate is inline'.	2 / 3
	Total	10 / 12 Passed

Description

90%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description with an explicit 'Use when' trigger covering what and when clearly. It is well-scoped to the NanoClaw bot security niche; the only weakness is that beyond the core 'checking' action it lists trigger contexts rather than a richer set of concrete capabilities.

Dimension	Reasoning	Score
Specificity	Names the domain ('security vulnerabilities in NanoClaw skills') and the core action of checking, but the remaining clauses ('before installing new skills', 'asked about security advisories') are trigger contexts rather than multiple distinct concrete capabilities, matching the 'names domain and some actions, but not comprehensive' anchor.	2 / 3
Completeness	The explicit 'Use when ...' clause answers both what it does (checking for security vulnerabilities) and when to use it (before installing, when asked about advisories), matching the 'clearly answers both what AND when' anchor.	3 / 3
Trigger Term Quality	'security vulnerabilities', 'installing new skills', and 'security advisories' are natural phrases a user would actually say, giving good coverage of natural trigger terms.	3 / 3
Distinctiveness Conflict Risk	Scoped to 'NanoClaw skills' and 'the bot' with security-specific triggers, forming a clear niche unlikely to fire for unrelated skills.	3 / 3
	Total	11 / 12 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning
relative_links	Relative link issues: 2 missing	Warning

	Total	14 / 16 Passed

Repository: prompt-security/clawsec
Path: skills/clawsec-nanoclaw/SKILL.md
Commit: c6194eb

Reviewed: 14 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.