agent-security-manager

Agent skill for security-manager - invoke with $agent-security-manager

1.54x

Quality

18%

Does it follow best practices?

Impact

82%

1.54x

Average score across 3 eval scenarios

Securityby

Medium

Suggest reviewing before use

Fix and improve this skill with Tessl

tessl review fix ./.agents/skills/agent-security-manager/SKILL.md

Quality

Content

32%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a monolithic design document of non-executable pseudocode rather than an actionable skill: it reads like a specification dump with undefined dependencies, no workflow for Claude to follow, and no progressive disclosure. A stray second YAML frontmatter block in the body further signals structural confusion.

Suggestions

Split each class implementation into reference files (e.g., references/threshold-signatures.md, references/attack-detection.md) and keep SKILL.md as a concise overview with one-level-deep links, removing the stray second YAML frontmatter block from the body.

Replace the pseudocode with executable, dependency-resolved examples (real library calls or runnable scripts) and add a sequenced workflow with explicit validation checkpoints, especially around key rotation and backup recovery.

Cut the marketing-style closer and redundant capability restatements; assume Claude's knowledge of standard crypto concepts and state only the skill-specific procedures.

Dimension	Reasoning	Score
Conciseness	The ~630-line body is dominated by large speculative class implementations plus a fluff closing summary ('enterprise-grade cryptographic security, advanced threat detection...'), making it noticeably verbose with several padded sections, though it avoids explaining well-known basic concepts.	2 / 5
Actionability	Concrete class skeletons and phased protocols (DKG phases 1-5, key rotation) are provided, but the code is pseudocode: it depends on undefined methods and objects (this.curve, this.broadcastCommitments, this.generateSecureRandom, this.mcpTools, EllipticCurve), so nothing is executable.	3 / 5
Workflow Clarity	There is no top-level sequenced workflow or validation checkpoints; 'Core Responsibilities' is a topic list, and rough sequences exist only as code comments, with validation absent for risky operations like key rotation and backup recovery.	2 / 5
Progressive Disclosure	All ~600 lines of class code are inlined in a single SKILL.md with no bundle files at all; content that clearly belongs in separate reference files (the class implementations, MCP integration snippets) is inlined despite section headers existing.	2 / 5
	Total	9 / 20 Passed

Description

3%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is a placeholder-quality invocation hint rather than a capability description: it says nothing about what the skill does or when to use it, and offers no natural trigger terms. It would almost never be selected appropriately by a user's request.

Suggestions

Replace the description with a concrete capability statement, e.g., 'Implements threshold signatures, Byzantine/Sybil/Eclipse/DoS attack detection, and distributed key generation/rotation for consensus protocols.'

Add an explicit trigger clause: 'Use when securing distributed consensus protocols, managing threshold or distributed keys, or detecting consensus-layer attacks.'

Drop the meta invocation text ('Agent skill for... invoke with $agent-security-manager') and include natural synonyms users would actually say (Byzantine fault detection, key rotation, DKG).

Dimension	Reasoning	Score
Specificity	The description ('Agent skill for security-manager - invoke with $agent-security-manager') states only what the artifact is and how to invoke it, with no concrete capability or action verbs, matching the 'entirely vague; no concrete actions' anchor.	1 / 5
Completeness	Neither 'what' (no capability statement) nor 'when' (no 'Use when...' clause or equivalent) is present, hitting the lowest anchor for missing both.	1 / 5
Trigger Term Quality	Only internal/technical jargon appears ('security-manager', '$agent-security-manager'); none of the natural phrases a user would say when needing this skill (e.g., threshold signatures, attack detection, key rotation) are present.	1 / 5
Distinctiveness Conflict Risk	'security-manager' is a very broad domain with high overlap risk against any security-related skill, though it is not entirely generic; no distinctive triggers are given to disambiguate.	2 / 5
	Total	5 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (627 lines); consider splitting into references/ and linking	Warning

	Total	15 / 16 Passed

Repository: ruvnet/ruflo
Path: .agents/skills/agent-security-manager/SKILL.md
Commit: b14c79e

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.