agent-security-manager

Agent skill for security-manager - invoke with $agent-security-manager

1.54x

Quality

15%

Does it follow best practices?

Impact

82%

1.54x

Average score across 3 eval scenarios

Securityby

Medium

Suggest reviewing before use

Fix and improve this skill with Tessl

tessl review fix ./.agents/skills/agent-security-manager/SKILL.md

Quality

Content

22%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a verbose, monolithic dump of cryptographic class implementations rather than a lean skill: the code is non-executable pseudocode, there is no guided workflow with validation checkpoints, and nothing is split into reference files. It assumes little of Claude's competence and overflows the context budget.

Suggestions

Cut the body to a concise overview and move the full threshold-signature/ZKP/key-management implementations into separate reference files (e.g. references/threshold-signatures.md, references/attack-detection.md) linked one level deep.

Replace the stubbed pseudocode with a small, genuinely executable example and clearly mark which methods are illustrative stubs, so the guidance is actionable rather than a design document.

Add an explicit step-by-step workflow with validation checkpoints (e.g. generate keys -> verify shares -> sign -> verify signature, with retry-on-failure) for the security and key-rotation operations.

Dimension	Reasoning	Score
Conciseness	The body is roughly 600 lines dominated by full JavaScript class implementations of threshold cryptography, ZKPs, bulletproofs, DKG and attack detectors — a heavily padded reference dump that explains/implements concepts rather than giving lean skill guidance, matching 'verbose; padded with unnecessary context'.	1 / 3
Actionability	The code is structurally concrete but is effectively pseudocode: nearly every class calls undefined helpers and references undefined types (EllipticCurve, BehaviorAnalyzer, this.curve.multiply, this.generateSecretPolynomial, etc.), so it is not executable as written — fitting 'pseudocode instead of executable code; missing key details'.	2 / 3
Workflow Clarity	There is no sequenced end-to-end workflow with validation checkpoints for the user; it is a catalog of component classes, and the destructive/batch-sensitive security and key-rotation operations lack any validate->fix->retry feedback loop, matching 'steps unclear or missing; no validation mentioned for risky operations'.	1 / 3
Progressive Disclosure	The file has section headers giving some structure, but it is monolithic — references/, scripts/ and assets/ are empty and the large code implementations that belong in separate reference files are all inlined, matching 'some structure but content that should be separate is inline'.	2 / 3
	Total	6 / 12 Passed

Description

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is essentially a bare label plus an invocation string: it conveys no concrete capabilities, no natural trigger terms, and no usage guidance. It fails to tell Claude what the skill does or when to invoke it.

Suggestions

Replace the label with concrete actions, e.g. 'Implements threshold signatures, Byzantine/Sybil/Eclipse/DoS attack detection, and distributed key management for consensus protocols.'

Add an explicit 'Use when...' clause with natural trigger terms users would say, such as 'Use when securing a consensus protocol, detecting Byzantine or Sybil attacks, or managing distributed signing keys.'

Drop the '$agent-security-manager' invocation syntax from the description — it is not a natural user phrase and adds no trigger value.

Dimension	Reasoning	Score
Specificity	The description 'Agent skill for security-manager - invoke with $agent-security-manager' names no concrete actions at all; it only labels the skill and gives an invocation string, matching the 'vague or no actions; abstract language' anchor.	1 / 3
Completeness	It offers only a weak 'what' (a label) and entirely omits any 'when' / 'Use when...' trigger guidance, so it is missing the when clause and has a very weak what — the missing-trigger cap is irrelevant since it already scores at the floor.	1 / 3
Trigger Term Quality	The only keyword-like token is the slash-invocation '$agent-security-manager'; there are no natural phrases a user would say when needing this skill, fitting 'no natural keywords; technical jargon or overly generic'.	1 / 3
Distinctiveness Conflict Risk	Naming a specific 'security-manager' agent gives it a somewhat distinct niche, but the phrasing is generic and could still overlap with other security skills, matching 'somewhat specific but could still overlap'.	2 / 3
	Total	5 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (627 lines); consider splitting into references/ and linking	Warning

	Total	15 / 16 Passed

Repository: ruvnet/ruflo
Path: .agents/skills/agent-security-manager/SKILL.md
Commit: 26c35b5

Reviewed: about 6 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.