agent-v3-security-architect

Agent skill for v3-security-architect - invoke with $agent-v3-security-architect

1.36x

Quality

—

Does it follow best practices?

Impact

93%

1.36x

Average score across 3 eval scenarios

Securityby

Advisory

Suggest reviewing before use

Quality

Content

50%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body delivers genuinely useful, concrete security guidance — CVE lists, code patterns, and deliverables — but is undermined by corrupted path separators, decorative padding, a stray embedded frontmatter block, and missing validation feedback loops. It is competent but not polished.

Suggestions

Fix the corrupted separators: replace "$" with "/" in paths and package names (e.g. api/auth-service.ts, @anthropic-ai/claude-code) so commands and paths are copy-paste ready.

Remove or relocate the embedded second YAML/hooks block and the decorative emoji echo statements; keep only the security content that Claude does not already know.

Add explicit validation checkpoints within each remediation step (fix -> run npm audit / tests -> only proceed on pass) to close the workflow feedback-loop gap.

Dimension	Reasoning	Score
Conciseness	The body is mostly concrete but padded with decorative emoji echo statements, an ASCII threat-model box, and a redundant mission intro; it could be tightened to earn the lean-anchor score.	2 / 3
Actionability	It provides real TypeScript examples and specific file/line targets, but corrupted path separators ("api$auth-service.ts", "@anthropic-ai$claude-code", "high$critical") break copy-paste readiness and leave key details malformed.	2 / 3
Workflow Clarity	Work is sequenced by phase and timelines with deliverable checklists, but for destructive security changes there is no explicit validate-fix-retry feedback loop; validation appears only as end success metrics, not embedded checkpoints.	2 / 3
Progressive Disclosure	The ~175-line document is well-sectioned but monolithic with no bundle files, and the stray second YAML/hooks block is mis-organized inline content that would be better split out or removed.	2 / 3
	Total	8 / 12 Passed

Description

35%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is a bare role label plus an invocation token rather than a capability statement. It omits concrete actions and any natural-language trigger guidance, making it weak at surfacing the skill when needed.

Suggestions

Replace the label with concrete actions, e.g. "Performs threat modeling, plans CVE remediation, and establishes secure-by-default patterns for the v3 codebase."

Add an explicit trigger clause such as "Use when addressing security vulnerabilities, planning CVE fixes, or designing secure architecture."

Drop the invocation-token meta-instruction from the description; it does not communicate capability or trigger conditions.

Dimension	Reasoning	Score
Specificity	The description names a specific domain ("v3-security-architect") but lists no concrete actions, only the role label and an invocation token; it sits above pure vagueness but below the multi-action anchor.	2 / 3
Completeness	It offers only a weak "what" ("Agent skill for v3-security-architect") and no "Use when..." trigger guidance; per the rubric a missing when-clause caps completeness at 2, and the what is itself barely present.	2 / 3
Trigger Term Quality	The only trigger is the invocation token "$agent-v3-security-architect" — technical jargon a user would not naturally say — with no natural keywords like "security", "vulnerability", or "threat model".	1 / 3
Distinctiveness Conflict Risk	The named role is somewhat specific, but the generic "Agent skill for X" form and lack of distinct triggers mean it could overlap with other v3 fleet agents.	2 / 3
	Total	7 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: ruvnet/claude-flow
Commit: 8ae8752

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.