clawsec-suite

ClawSec suite manager with embedded advisory-feed monitoring, cryptographic signature verification, approval-gated malicious-skill response, and guided setup for additional security skills.

Quality

72%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/clawsec-suite/SKILL.md

Quality

Content

77%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable with well-sequenced, validation-gated workflows, but it is somewhat verbose (duplicated catalog-discovery, conceptual exploitability padding) and its progressive disclosure is undercut by references to bundle files that do not actually exist.

Suggestions

Ship the referenced files (HEARTBEAT.md, skill.json, advisories/feed.json, hooks/clawsec-advisory-guardian/) or remove/update the dangling references so navigation targets resolve.

Move the detailed allowlist config and exploitability methodology into separate reference files and link to them from a concise overview, rather than keeping them inline.

Dedupe the catalog-discovery instructions (currently described in both 'Included vs Optional Protections' and 'Optional Skill Installation') into a single section to tighten conciseness.

Dimension	Reasoning	Score
Conciseness	Most sections are operational and earn their tokens, but the catalog-discovery flow is explained twice ('Included vs Optional Protections' and 'Optional Skill Installation') and the 'Exploitability Context' section restates methodology concepts Claude already understands. It is above level 1 (not padded with basic concept explanations) but below level 3 because some content could be tightened or deduplicated.	2 / 3
Actionability	The body provides many copy-paste-ready, fully executable blocks — the manual-install flow with openssl/shasum/jq verification, the guarded-install invocations with explicit flags, and the quick-feed-check jq pipeline. This matches the level-3 anchor of fully executable commands with specific examples. It is well above level 2 (no pseudocode; key details like env overrides and exit codes are present).	3 / 3
Workflow Clarity	Multi-step processes are explicitly sequenced with validation checkpoints: the manual install verifies the key fingerprint then the checksums signature then the archive hash before installing, and the guarded-install flow documents the first/second-confirmation loop with exit code 42. This matches the level-3 anchor of clear sequences with explicit validation and error-recovery feedback loops, and is not capped because destructive/batch operations do have verification steps.	3 / 3
Progressive Disclosure	Sections are organized, but against the actual bundle only scripts/*.mjs exist — referenced paths like HEARTBEAT.md, skill.json, advisories/feed.json, hooks/clawsec-advisory-guardian/, and ../../wiki/exploitability-scoring.md are missing from the bundle. Inline material that could be split out (the long allowlist config and exploitability methodology) stays in SKILL.md. It is above level 1 (real section structure and real script files exist) but below level 3 because references point to non-existent files and some separable content is inline.	2 / 3
	Total	10 / 12 Passed

Description

67%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, distinctive, and in third person, but it omits any explicit 'Use when...' trigger guidance and relies on technical jargon rather than natural user phrasing. Its main weakness is completeness and trigger discoverability.

Suggestions

Add an explicit 'Use when...' clause stating when to invoke the skill, e.g. 'Use when the user mentions ClawSec, security advisories, malicious skills, or wants to verify/install security skills'.

Soften jargon with natural trigger terms users would actually say ('security advisory feed', 'verify skill signatures', 'block malicious skills') alongside the technical phrasing.

Keep the four concrete capabilities but pair them with a short trigger clause to lift completeness from 2 to 3.

Dimension	Reasoning	Score
Specificity	The description lists multiple concrete actions — 'embedded advisory-feed monitoring, cryptographic signature verification, approval-gated malicious-skill response, and guided setup for additional security skills' — matching the level-3 anchor for several specific concrete actions. It is above level 2 (which only names a domain and some actions) because four distinct capabilities are enumerated, and uses third-person voice per the guidelines.	3 / 3
Completeness	It clearly answers 'what' (the four capabilities) but provides no 'Use when...' clause or equivalent explicit trigger guidance, so per the judging guidelines completeness is capped at 2. It is above level 1 because 'what' is explicit and concrete, but below level 3 because 'when to use it' is entirely absent.	2 / 3
Trigger Term Quality	Terms like 'advisory-feed monitoring', 'cryptographic signature verification', and 'approval-gated malicious-skill response' are relevant but lean technical; natural user phrasings such as 'security advisory', 'malicious skill', or 'verify signatures' are present only in jargon form and common variations are missing. It is not level 3 (no good coverage of natural terms users would say) nor level 1 (the keywords are relevant, not purely generic jargon).	2 / 3
Distinctiveness Conflict Risk	'ClawSec suite manager' carves out a clear, product-specific security niche with distinct triggers (advisory feed + malicious-skill response) that would not fire for general-purpose skills. It is above level 2 (which could overlap with similar skills) because the scope is narrowly scoped to the ClawSec security suite.	3 / 3
	Total	10 / 12 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning
relative_links	Relative link issues: 1 suspicious	Warning

	Total	14 / 16 Passed

Repository: prompt-security/clawsec
Path: skills/clawsec-suite/SKILL.md
Commit: c6194eb

Reviewed: 14 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.