agent-v3-security-architect

Agent skill for v3-security-architect - invoke with $agent-v3-security-architect

1.36x

Quality

36%

Does it follow best practices?

Impact

93%

1.36x

Average score across 3 eval scenarios

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./.agents/skills/agent-v3-security-architect/SKILL.md

Quality

Content

65%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is strong on actionability with concrete executable security patterns and specific CVE targets, but it is a monolithic document with a duplicated frontmatter block and lacks inline validation feedback loops in its remediation workflow. Conciseness and progressive disclosure are the main weaknesses.

Suggestions

Add an explicit validate→fix→re-validate loop after each CVE remediation (e.g., "run npm audit; if high/critical remain, fix and re-run") to lift workflow clarity.

Remove the stray second YAML frontmatter block and the echo-only hooks to eliminate redundant padding.

Move the secure-patterns catalog and threat model into referenced files (e.g., SECURE-PATTERNS.md, THREAT-MODEL.md) and link to them from a concise overview, fixing the malformed "$" path separators in the file references.

Dimension	Reasoning	Score
Conciseness	Most of the body is genuinely useful and specific (CVE list, code patterns, checklists), but a stray duplicated YAML frontmatter block, decorative echo-only hooks, and a box-drawing threat-model diagram add padding that could be tightened, matching the mostly-efficient-but-could-tighten anchor rather than the lean level-3 anchor.	2 / 3
Actionability	The secure-patterns catalog provides complete, valid, copy-paste-ready TypeScript (Zod schema, securePath with path.resolve, execFile without shell) and concrete remediation actions with specific targets, matching the fully-executable anchor.	3 / 3
Workflow Clarity	Work is sequenced into Phase 1 Week 1/2 with deliverable checklists, but there are no inline validate→fix→retry checkpoints for these security- and credential-changing operations — only a final "Validation Criteria" gate — so per the destructive-operations cap it cannot reach level 3.	2 / 3
Progressive Disclosure	The skill is well over 50 lines with no bundle files and no one-level-deep references; substantial content (patterns catalog, threat model, CVE details) lives inline in a single monolithic file, fitting the some-structure-but-content-should-be-separate anchor rather than the clear-overview-with-signaled-references anchor.	2 / 3
	Total	9 / 12 Passed

Description

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is a generic invocation template that fails to convey what the skill does or when to use it, relying entirely on a proper-noun token for distinctiveness. It scores at the floor on specificity, trigger terms, and completeness.

Suggestions

Replace the templated description with concrete actions, e.g. "Designs security architecture, performs threat modeling, and plans CVE remediation for v3."

Add an explicit "Use when..." trigger clause listing natural keywords users would say (security overhaul, threat model, CVE, vulnerability, secure-by-default).

Drop the "$agent-v3-security-architect" invocation token from the description; reserve it for usage docs so the description stays natural and conflict-resistant.

Dimension	Reasoning	Score
Specificity	The description only states "Agent skill for v3-security-architect - invoke with $agent-v3-security-architect" — it names no concrete actions or domain capabilities, matching the vague/no-actions anchor rather than the level-2 anchor that names a domain and some actions.	1 / 3
Completeness	It answers neither "what does this do" (no actions described) nor "when should Claude use it" (no "Use when..." clause), so both halves are missing per the level-1 anchor.	1 / 3
Trigger Term Quality	The only terms are the invocation token "$agent-v3-security-architect" and the proper noun "v3-security-architect"; no natural keywords a user would say (e.g., security, vulnerability, CVE, threat model) appear, fitting the technical-jargon/no-natural-keywords anchor.	1 / 3
Distinctiveness Conflict Risk	The proper-noun niche "v3-security-architect" makes it unlikely to trigger for unrelated skills, but the templated "Agent skill for X - invoke with $X" form is identical across sibling agent skills with no functional differentiation, so it could overlap with similar agent skills.	2 / 3
	Total	5 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: ruvnet/ruflo
Path: .agents/skills/agent-v3-security-architect/SKILL.md
Commit: 26c35b5

Reviewed: about 5 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.