agent-security-manager

Agent skill for security-manager - invoke with $agent-security-manager

1.54x

Quality

Does it follow best practices?

Impact

82%

1.54x

Average score across 3 eval scenarios

Securityby

Medium

Suggest reviewing before use

Fix and improve this skill with Tessl

tessl review fix ./.agents/skills/agent-security-manager/SKILL.md

Quality

Content

0%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

This skill is a massive dump of non-executable pseudocode masquerading as a security implementation guide. It explains concepts Claude already understands (cryptographic primitives, attack types) through verbose class definitions that reference undefined dependencies and cannot be run. The content lacks any actionable workflow, validation steps, or practical guidance for actually implementing security in a consensus system.

Suggestions

Replace the massive pseudocode classes with a concise overview of security responsibilities and 2-3 small, executable code snippets showing actual usage patterns with real libraries

Add a clear step-by-step workflow for securing a consensus round, including explicit validation checkpoints (e.g., 'verify threshold signature before proceeding to consensus')

Split detailed implementations into separate reference files (e.g., THRESHOLD_SIGNATURES.md, ATTACK_DETECTION.md) and keep SKILL.md as a concise overview with navigation links

Remove explanations of concepts Claude already knows (what Byzantine attacks are, how ZKPs work conceptually) and focus on project-specific configuration, thresholds, and integration points

Dimension	Reasoning	Score
Conciseness	Extremely verbose at ~500+ lines of code. Most of the code is pseudocode-style class implementations that Claude already understands conceptually. The content explains basic cryptographic concepts and attack types that Claude knows well, and the massive code blocks are not executable (they reference undefined classes like EllipticCurve, BehaviorAnalyzer, etc.).	1 / 3
Actionability	Despite the volume of code, none of it is executable or copy-paste ready. Classes reference undefined dependencies (EllipticCurve, EncryptedKeyStore, BehaviorAnalyzer, etc.), methods call unimplemented functions, and there are no concrete commands, installation steps, or real-world usage examples. This is architectural pseudocode dressed up as implementation.	1 / 3
Workflow Clarity	There is no clear workflow for when or how to use this security manager. The content presents class definitions without explaining the sequence of operations, when to invoke specific security checks, or how to validate that security measures are working. No validation checkpoints or error recovery steps are provided despite dealing with critical security operations.	1 / 3
Progressive Disclosure	All content is dumped into a single monolithic file with no references to supporting documents. Hundreds of lines of class implementations are inlined that could be split into separate reference files. No bundle files exist to support the content, and there's no navigation structure to help find specific security features.	1 / 3
	Total	4 / 12 Passed

Description

0%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

This description is essentially a label with an invocation command, providing no useful information about what the skill does, when to use it, or what triggers should activate it. It fails on every dimension because it lacks concrete actions, natural trigger terms, explicit 'when to use' guidance, and any distinguishing characteristics.

Suggestions

Add specific concrete actions the skill performs, e.g., 'Scans code for vulnerabilities, manages access permissions, audits security configurations, reviews dependency risks.'

Add an explicit 'Use when...' clause with natural trigger terms, e.g., 'Use when the user asks about security vulnerabilities, access control, permission management, CVEs, or security audits.'

Remove the invocation instruction ('invoke with $agent-security-manager') from the description, as it wastes space that should be used for capability and trigger information.

Dimension	Reasoning	Score
Specificity	The description provides no concrete actions whatsoever. 'Agent skill for security-manager' is entirely vague and does not describe what the skill actually does.	1 / 3
Completeness	Neither 'what does this do' nor 'when should Claude use it' is answered. The description only states it's an agent skill and how to invoke it, with no functional or contextual information.	1 / 3
Trigger Term Quality	The only keyword is 'security-manager', which is a tool name rather than a natural term a user would say. There are no natural language trigger terms like 'vulnerability', 'scan', 'permissions', etc.	1 / 3
Distinctiveness Conflict Risk	'Security-manager' is extremely generic and could overlap with any security-related skill. There are no distinguishing details about what specific security tasks this handles.	1 / 3
	Total	4 / 12 Passed

Validation

90%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 10 / 11 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (627 lines); consider splitting into references/ and linking	Warning

	Total	10 / 11 Passed

Repository: ruvnet/claude-flow
Path: .agents/skills/agent-security-manager/SKILL.md
Commit: 913f9ea

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.