cc-skill-security-review

This skill ensures all code follows security best practices and identifies potential vulnerabilities. Use when implementing authentication or authorization, handling user input or file uploads, or creating new API endpoints.

Quality

67%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/cc-skill-security-review/SKILL.md

Quality

Content

65%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable reference dense with executable, copy-paste-ready security code, but it is verbose, duplicates content between SKILL.md and the guide, and lacks a sequenced end-to-end review workflow with feedback loops. Progressive disclosure is present but undermined by inline bulk and duplication.

Suggestions

Remove the verbatim duplication of the description and 'When to Use' from the body, and consolidate the per-area code examples into references/detailed-guide.md so SKILL.md stays a lean overview.

Add an explicit end-to-end workflow (e.g. run each category checklist -> record failures -> fix -> re-verify -> only deploy when all pass) to give the review a sequenced feedback loop.

Trim obvious inline comments like '// Hardcoded secret' and '// DANGEROUS - SQL Injection vulnerability' that restate what the code already shows.

Dimension	Reasoning	Score
Conciseness	Mostly efficient code-and-checklist content, but the opening line and 'When to Use' duplicate the description verbatim and several commented examples (e.g. '// Hardcoded secret', '// DANGEROUS - SQL Injection vulnerability') add padding Claude does not need.	3 / 5
Actionability	Extensive copy-paste-ready code covers the common cases: Zod schemas, file-upload validation, parameterized queries, httpOnly cookies, RLS policies, DOMPurify, CSP headers, CSRF tokens, rate limiting, and npm audit commands.	5 / 5
Workflow Clarity	Each area has verification checkboxes, but there is no end-to-end security-review sequence and no review->fix->re-verify feedback loop; it reads as parallel checklists rather than a sequenced workflow.	3 / 5
Progressive Disclosure	The detailed guide is clearly signaled and one level deep, but the bulk of the code and checklists is inlined in SKILL.md and largely duplicated in references/detailed-guide.md, so the split is not clean.	3 / 5
	Total	14 / 20 Passed

Description

70%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A solid description with explicit what-and-when structure and natural trigger phrases, slightly held back by high-level capability wording and a few missing natural synonyms. It is clearly distinct as a security skill but broad enough to risk minor overlap with general code-review.

Suggestions

Replace generic capability verbs with concrete actions, e.g. 'Audits code for hardcoded secrets, injection risks, and missing auth checks' instead of 'ensures all code follows security best practices'.

Add the natural trigger terms already in the body ('working with secrets or credentials', 'implementing payment features', 'storing or transmitting sensitive data') to the description.

Tighten the when-clause to the 3-4 highest-signal triggers to reduce overlap with general code-review skills.

Dimension	Reasoning	Score
Specificity	Names the domain ('security best practices') plus 1-2 actions ('ensures all code follows security best practices', 'identifies potential vulnerabilities'), but those actions are generic and the concrete triggers belong to the when-clause rather than capabilities.	3 / 5
Completeness	Explicitly answers both what ('ensures all code follows security best practices and identifies potential vulnerabilities') and when ('Use when implementing authentication...'), though the 'what' is somewhat high-level and the when could list more triggers.	4 / 5
Trigger Term Quality	Natural phrases a user would say ('authentication or authorization', 'user input or file uploads', 'new API endpoints') are present, but several natural terms from the body (secrets, credentials, payment, sensitive data) are missing.	4 / 5
Distinctiveness Conflict Risk	A clear security niche with concrete triggers minimizes conflict risk, though 'all code follows security best practices' is broad enough to overlap with general code-review skills.	4 / 5
	Total	15 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: sickn33/agentic-awesome-skills
Path: skills/cc-skill-security-review/SKILL.md
Commit: b1aebac

Reviewed: ~17 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.