picoclaw-security-guardian

Picoclaw security posture skill with advisory awareness, configuration drift detection, and supply-chain verification guidance.

Quality

76%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/picoclaw-security-guardian/SKILL.md

Quality

Content

85%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, executable security skill body with concrete commands, clear validation checkpoints, and one-level-deep references to real bundle scripts. The only notable drag is the lengthy, partly-duplicative release-verification bash block.

Suggestions

Move the long standalone release-artifact verification bash block into a referenced script or reference file, keeping the inline snippet minimal.

Note that the release-verification VERSION/TAG values are time-sensitive and will drift; consider sourcing them from skill.json rather than hardcoding.

Consider an explicit numbered preflight ordering (verify manifest -> verify archive -> install) to make the install flow's checkpoints unmistakable.

Dimension	Reasoning	Score
Conciseness	The body is largely lean executable commands with little concept padding, but the long standalone release-artifact verification bash block overlaps with the chain-of-supply section and could be tightened, keeping it just below the lean-and-efficient anchor.	2 / 3
Actionability	Fully executable bash and node commands with explicit arguments, paths, and expected outputs (e.g. check_advisories.mjs, verify_supply_chain.mjs invocation) are copy-paste ready.	3 / 3
Workflow Clarity	Each capability is sequenced with explicit validation checkpoints and fail-closed gates (checksum mismatch -> exit 1, --fail-on critical), and the supply-chain flow has explicit error branches and retry semantics.	3 / 3
Progressive Disclosure	The overview references one-level-deep bundle files (scripts/*.mjs, all present) and a single wiki module doc, clearly signaled and well-organized by section rather than as a monolithic wall of text.	3 / 3
	Total	11 / 12 Passed

Description

67%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A specific, narrowly-scoped security skill description that clearly conveys capability, but it omits any explicit use-trigger guidance and leans on internal jargon rather than natural user language. Adding a 'Use when...' clause would close the main gap.

Suggestions

Add an explicit trigger clause, e.g. 'Use when reviewing Picoclaw security posture, checking for advisories, or verifying release artifacts.'

Soften jargon with natural phrasings users would say (e.g. 'security alerts/CVEs' alongside 'advisory awareness').

Mirror the operator-facing framing from the body so the description previews concrete actions like profile generation and drift comparison.

Dimension	Reasoning	Score
Specificity	Names the security-posture domain and three concrete capabilities ("advisory awareness, configuration drift detection, and supply-chain verification guidance"), matching the multiple-concrete-actions anchor.	3 / 3
Completeness	It clearly states what the skill does but never says when to use it (no "Use when..." trigger), which per the guidelines caps completeness at 2.	2 / 3
Trigger Term Quality	Terms are domain-accurate but jargon-heavy and internal ("advisory awareness", "configuration drift", "supply-chain verification"); it lacks the natural phrasings a user would say, so it sits at 'some relevant keywords but missing common variations'.	2 / 3
Distinctiveness Conflict Risk	The Picoclaw-specific security niche with its named checks is clearly distinguishable and unlikely to fire for unrelated skills.	3 / 3
	Total	10 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: prompt-security/clawsec
Path: skills/picoclaw-security-guardian/SKILL.md
Commit: c6194eb

Reviewed: 14 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.