Name: agent-v3-security-architect
Rating: 61.8 (1 reviews)
Author: ruvnet

Blog Docs Log in Get started

agent-v3-security-architect

Agent skill for v3-security-architect - invoke with $agent-v3-security-architect

1.36x

Quality

43%

Does it follow best practices?

Impact

93%

1.36x

Average score across 3 eval scenarios

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./.agents/skills/agent-v3-security-architect/SKILL.md

The canonical home for this skill is agent-v3-security-architect in ruvnet/claude-flow

Quality

Content

57%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is a reasonably actionable security-architecture brief with concrete code patterns and a clear CVE list, but it is held back by decorative/verbose padding, time-sensitive fields inline, missing validation checkpoints in the remediation workflow, and no use of reference files to split detail out.

Suggestions

Move the secure-patterns catalog and threat model into reference files (e.g. SECURE-PATTERNS.md, THREAT-MODEL.md) and link to them one level deep, keeping SKILL.md as an overview.

Add explicit validation checkpoints to the remediation workflow (e.g. 'after each CVE fix, run npm audit and the security regression suite; only proceed when clean') with a fix-and-retry loop.

Remove decorative emoji headers and the ASCII-art box, and relocate the hardcoded version/date and 'Phase 1 Week N' timeline to a separate plan or deprecated section so the core guidance stays lean.

Dimension	Reasoning	Score
Conciseness	The body is mostly efficient with lists and code blocks, but decorative elements (emoji headers, an ASCII-art threat-model box) and time-sensitive fields hardcoded inline (version '3.0.0-alpha', 'updated: 2026-01-04', 'Phase 1 Week 1') add tokens that do not earn their place.	3 / 5
Actionability	Concrete, executable TypeScript snippets for Zod validation, path sanitization, and execFile usage, plus CVE fixes tied to specific files and actions; minor gaps remain where fixes point to 'Multiple spawn() locations' without showing the change.	4 / 5
Workflow Clarity	A rough phase/timeline sequence and a terminal 'Validation Criteria' checklist exist, but the destructive security changes (auth hashing, command execution) lack embedded validate-then-proceed checkpoints with feedback loops, capping this at 3.	3 / 5
Progressive Disclosure	Section headers provide structure, but with no bundle files present the threat model, secure-patterns catalog, and CVE-remediation plan are all inlined in a single ~130-line file rather than split into one-level-deep references.	3 / 5
	Total	13 / 20 Passed

Description

28%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

This is a low-quality, templated description that names the agent but never states what it actually does (security overhaul, threat modeling, CVE remediation) or when to invoke it in natural terms. It reads as an auto-generated wrapper rather than a meaningful trigger description.

Suggestions

Replace the templated wrapper with a concrete statement of what the skill does, e.g. 'Designs security architecture, performs threat modeling, and plans CVE remediation for the v3 codebase.'

Add an explicit 'Use when...' clause with natural trigger terms users would say, such as 'security review', 'threat model', 'vulnerability remediation', or 'CVE fix'.

Drop the 'invoke with $agent-v3-security-architect' syntax from the description; invocation mechanics do not help Claude decide when to use the skill.

Dimension	Reasoning	Score
Specificity	The description names the domain ('v3-security-architect') but provides zero concrete actions, reading as a generic wrapper ('Agent skill for v3-security-architect - invoke with $agent-v3-security-architect').	2 / 5
Completeness	It offers only a vague 'what' ('agent skill for X') and no real 'when'; the 'invoke with $...' clause is invocation syntax, not explicit trigger guidance, so it stays below the 3 cap anchor.	2 / 5
Trigger Term Quality	The only keyword is the agent name itself, and 'invoke with $...' is command syntax rather than natural phrases a user would say; common natural terms like 'security', 'threat model', or 'CVE' are absent.	2 / 5
Distinctiveness Conflict Risk	The specific agent name distinguishes it from unrelated skills, but the templated 'Agent skill for X - invoke with $X' pattern overlaps heavily with sibling agent-v3-* skills sharing the same format.	3 / 5
	Total	9 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: ruvnet/ruflo
Path: .agents/skills/agent-v3-security-architect/SKILL.md
Commit: fa13ee4

Reviewed: about 4 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.