agent-v3-security-architect

Agent skill for v3-security-architect - invoke with $agent-v3-security-architect

1.36x

Quality

Does it follow best practices?

Impact

93%

1.36x

Average score across 3 eval scenarios

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./.agents/skills/agent-v3-security-architect/SKILL.md

Quality

Content

14%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

This skill reads as a project management brief or role description rather than an actionable skill that teaches Claude how to perform security tasks. While it contains a few useful code patterns (path sanitization, safe command execution), the majority of content is organizational overhead—timelines, team coordination, success metrics, and checklists—that doesn't help Claude execute security work. The lack of validation workflows for security-critical operations is a significant gap.

Suggestions

Remove project management content (timelines, team coordination, success metrics, phase planning) and focus on concrete security implementation patterns with complete, executable code examples.

Add explicit validation workflows for each CVE fix: e.g., 'After updating bcrypt: 1. Run `npm test -- --grep security`, 2. Verify hash format matches `$2b$12$...`, 3. Confirm old SHA-256 hashes are migrated.'

Convert the deliverables checklist into actual reference files in a bundle, then link to them from a concise overview in SKILL.md.

Replace vague actions like 'Implement bcrypt with 12 rounds' with complete before/after code snippets showing the exact transformation needed.

Dimension	Reasoning	Score
Conciseness	Extremely verbose with project management content (timelines, phases, coordination sections, success metrics) that doesn't teach Claude how to do anything. The threat model ASCII diagram, team coordination details, and checklist-style deliverables are padding that Claude doesn't need. Much of this reads like a project plan rather than an actionable skill.	1 / 3
Actionability	The secure patterns catalog provides some concrete, executable TypeScript examples (Zod validation, path sanitization, safe command execution), which is genuinely useful. However, the CVE fixes are described at a high level ('Implement bcrypt with 12 rounds') without complete implementation code, and most of the document describes what to do rather than showing how.	2 / 3
Workflow Clarity	Despite dealing with security-critical operations (CVE remediation, dependency updates, credential changes), there are no validation checkpoints, no feedback loops, and no clear step-by-step workflow. The phases and timelines are project management artifacts, not executable workflows with verification steps.	1 / 3
Progressive Disclosure	The content is a monolithic wall of text with no bundle files to reference. It references deliverable documents (SECURITY-ARCHITECTURE.md, THREAT-MODEL.md, etc.) as things to create rather than as existing references to navigate to. No structure for progressive discovery of information.	1 / 3
	Total	5 / 12 Passed

Description

0%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

This description is essentially non-functional as a skill selector. It provides no information about what the skill does, when to use it, or what domain it covers. The only content is an invocation command, which is useless for Claude's skill selection process.

Suggestions

Add concrete actions describing what the security architect skill does, e.g., 'Performs threat modeling, reviews system architecture for security vulnerabilities, designs security controls, and creates security architecture diagrams.'

Add an explicit 'Use when...' clause with natural trigger terms, e.g., 'Use when the user asks about threat modeling, security architecture, security review, attack surface analysis, or designing secure systems.'

Remove the invocation command from the description (it belongs in usage instructions, not the description) and replace with domain-specific keywords users would naturally use.

Dimension	Reasoning	Score
Specificity	The description contains no concrete actions whatsoever. It only states it is an 'agent skill' with an invocation command, providing no information about what the skill actually does.	1 / 3
Completeness	Neither 'what does this do' nor 'when should Claude use it' is answered. The description only provides an invocation command with no functional or contextual information.	1 / 3
Trigger Term Quality	The only potentially relevant term is 'security-architect' embedded in the agent name, but there are no natural keywords a user would say. No terms like 'security review', 'threat model', 'vulnerability', or 'architecture' are present.	1 / 3
Distinctiveness Conflict Risk	The description is so vague that Claude would have no basis to distinguish this skill from any other agent skill. The only hint is 'security-architect' in the name, but without elaboration it provides minimal differentiation.	1 / 3
	Total	4 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 11 / 11 Passed

Validation for skill structure

No warnings or errors.

Repository: ruvnet/claude-flow
Path: .agents/skills/agent-v3-security-architect/SKILL.md
Commit: 913f9ea

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.