agent-v3-security-architect

Agent skill for v3-security-architect - invoke with $agent-v3-security-architect

1.36x

Quality

11%

Does it follow best practices?

Impact

93%

1.36x

Average score across 3 eval scenarios

Securityby

Advisory

Suggest reviewing before use

Optimize this skill with Tessl

npx tessl skill review --optimize ./.agents/skills/agent-v3-security-architect/SKILL.md

Quality

Discovery

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

This is an extremely weak description that provides virtually no useful information for skill selection. It contains only an invocation command and a generic label, with no actions, triggers, or context. Claude would have no basis for choosing this skill appropriately from a set of available skills.

Suggestions

Add concrete actions describing what the skill does, e.g., 'Performs security architecture reviews, identifies threat vectors, designs secure system architectures, and evaluates compliance with security frameworks.'

Add an explicit 'Use when...' clause with natural trigger terms, e.g., 'Use when the user asks about security architecture, threat modeling, security design patterns, access control design, or system hardening.'

Remove the invocation command from the description (it's operational metadata, not descriptive) and replace with domain-specific keywords users would naturally use.

Dimension	Reasoning	Score
Specificity	The description contains no concrete actions whatsoever. It only states it is an 'agent skill' with an invocation command, providing no information about what the skill actually does.	1 / 3
Completeness	Neither 'what does this do' nor 'when should Claude use it' is answered. The description only provides an invocation command with no functional or contextual information.	1 / 3
Trigger Term Quality	The only potentially relevant term is 'security-architect' embedded in the agent name, but there are no natural keywords a user would say. No terms like 'security review', 'threat model', 'vulnerability', or 'architecture' are present.	1 / 3
Distinctiveness Conflict Risk	The description is so vague that it provides no distinguishing characteristics. The embedded term 'security-architect' hints at a domain but without any elaboration, it could conflict with any security-related skill.	1 / 3
	Total	4 / 12 Passed

Implementation

22%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

This skill reads more like a project plan or requirements document than an actionable skill for Claude. While it contains some useful concrete code patterns (path sanitization, safe command execution, input validation), the majority of content is project management overhead—timelines, coordination notes, success metrics, and deliverable checklists—that doesn't teach Claude how to perform security tasks. The lack of sequential workflows with validation steps is a critical gap for security-sensitive operations.

Suggestions

Replace project management content (timelines, coordination sections, success metrics) with step-by-step workflows that include explicit validation checkpoints, e.g., 'Run npm audit after each dependency update and verify 0 critical vulnerabilities before proceeding.'

Add a clear sequential workflow for CVE remediation: detect → fix → validate → verify, with specific commands at each step (e.g., 'npm audit', 'npm update', 'npm audit --json | jq .vulnerabilities').

Remove the deliverables checklist and coordination sections entirely—these are project artifacts, not skill instructions. Replace with concrete examples of what the security architecture document should contain.

Consolidate the secure patterns into a referenced SECURE-PATTERNS.md file and keep only a brief summary with one example in the main skill body to improve conciseness and progressive disclosure.

Dimension	Reasoning	Score
Conciseness	The skill is extremely verbose with extensive project management content (timelines, phases, coordination sections, success metrics, checklists) that doesn't provide actionable guidance Claude doesn't already know. The threat model ASCII diagram, deliverable checklists, and coordination sections are padding that consume tokens without teaching Claude how to do anything specific.	1 / 3
Actionability	The code examples for path sanitization, input validation, and command execution are concrete and executable TypeScript. However, much of the content is descriptive project planning rather than executable guidance—listing CVEs with vague 'Action' items like 'Update to @anthropic-ai$claude-code@^2.0.31' without showing how, and deliverable checklists without instructions on how to produce them.	2 / 3
Workflow Clarity	Despite dealing with security-critical operations (CVE remediation, dependency updates, credential changes), there is no clear sequential workflow with validation checkpoints. The content lists what needs to be done but not in what order with what verification steps. Missing feedback loops for destructive security changes caps this at 1.	1 / 3
Progressive Disclosure	The content references deliverable documents (SECURITY-ARCHITECTURE.md, CVE-REMEDIATION-PLAN.md, etc.) but these are outputs to create, not existing references to navigate to. The content itself is a monolithic document with headers providing some structure, but inline content that could be split into separate files (e.g., the full secure patterns catalog) remains embedded.	2 / 3
	Total	6 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 11 / 11 Passed

Validation for skill structure

No warnings or errors.

Repository: ruvnet/claude-flow
Commit: f547cec

Reviewed: 4 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.