007

Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, incident response, and infrastructure security for any project.

Quality

58%

Does it follow best practices?

Impact

—

No eval scenarios have been run

Securityby

Passed

No known issues

Optimize this skill with Tessl

npx tessl skill review --optimize ./plugins/antigravity-awesome-skills-claude/skills/007/SKILL.md

Quality

Content

35%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

This skill is ambitious in scope but suffers from severe verbosity — it inlines content that should be in reference files (playbooks, checklists, threat modeling guides, scoring rubrics), resulting in a 400+ line monolith. The referenced scripts and reference files don't exist in the bundle, making many actionable commands non-functional. The workflow structure is reasonable but lacks validation checkpoints between phases, and hardcoded Windows paths reduce portability.

Suggestions

Move playbooks, checklists, STRIDE/PASTA details, and scoring rubrics into the referenced files (e.g., references/incident-playbooks.md, references/owasp-checklists.md) and keep only a concise summary with links in SKILL.md — this could reduce the file to under 100 lines.

Remove hardcoded Windows paths (C:\Users\renat\) and use relative paths (e.g., ./scripts/quick_scan.py) for portability.

Add explicit validation checkpoints between the 6 phases (e.g., 'Phase 1 complete when: surface map JSON generated and reviewed; proceed only after confirming all trust boundaries identified').

Provide the actual bundle files (scripts and references) or remove references to non-existent files to avoid misleading the user about available tooling.

Dimension	Reasoning	Score
Conciseness	Extremely verbose at 400+ lines. Explains concepts Claude already knows (what STRIDE stands for, what PDF is equivalent explanations for security concepts). Contains massive tables, checklists, and playbooks that should be in reference files. Hardcoded Windows file paths (C:\Users\renat\) add noise. The 'When to Use' and 'Do Not Use' sections are boilerplate. Much content repeats what's already in the overview.	1 / 3
Actionability	References specific scripts with concrete commands (e.g., `python scripts/quick_scan.py --target <caminho>`), and provides structured templates for attack scenarios and incident response. However, no bundle files are provided, so none of the referenced scripts actually exist, making the commands non-executable. The checklists and playbooks are detailed but more descriptive than truly executable.	2 / 3
Workflow Clarity	The 6-phase analysis process is clearly sequenced with a visual flow diagram, and each phase has defined steps. However, there are no explicit validation checkpoints between phases — the skill says '007 nunca pula fases' but doesn't define what constitutes completion of a phase or how to verify before proceeding. For destructive/batch security operations, this lack of validation gates is a gap.	2 / 3
Progressive Disclosure	References 10+ reference files and multiple scripts, which is good structure in principle. However, no bundle files are provided, so all references are unverifiable. The main SKILL.md itself is monolithic — the playbooks, checklists, STRIDE/PASTA details, and scoring system should all be in the referenced files rather than inline, creating a massive wall of content that defeats the purpose of progressive disclosure.	2 / 3
	Total	7 / 12 Passed

Description

82%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description excels at listing specific, concrete security capabilities with strong domain-specific trigger terms that users would naturally use. Its main weakness is the absence of an explicit 'Use when...' clause, which would help Claude know precisely when to select this skill. Adding trigger guidance would elevate this from a good to an excellent description.

Suggestions

Add a 'Use when...' clause such as 'Use when the user asks about security vulnerabilities, penetration testing, threat analysis, compliance checks, or securing code and infrastructure.'

Dimension	Reasoning	Score
Specificity	Lists multiple specific concrete actions: security audit, hardening, threat modeling with named frameworks (STRIDE/PASTA), Red/Blue Team exercises, OWASP checks, code review, incident response, and infrastructure security.	3 / 3
Completeness	Clearly answers 'what does this do' with a comprehensive list of security capabilities, but lacks an explicit 'Use when...' clause or equivalent trigger guidance, which caps this at 2 per the rubric guidelines.	2 / 3
Trigger Term Quality	Includes strong natural keywords users would say: 'security audit', 'threat modeling', 'OWASP', 'code review', 'incident response', 'Red/Blue Team', 'hardening', 'STRIDE', 'PASTA'. These cover a wide range of security-related terms users would naturally use.	3 / 3
Distinctiveness Conflict Risk	The security-specific terminology (STRIDE, PASTA, OWASP, Red/Blue Team, incident response) creates a clear niche that is unlikely to conflict with non-security skills. The combination of these distinct security domain terms makes it highly distinguishable.	3 / 3
	Total	11 / 12 Passed

Validation

81%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 9 / 11 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (656 lines); consider splitting into references/ and linking	Warning
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	9 / 11 Passed

Repository: sickn33/antigravity-awesome-skills
Commit: c59011f

Reviewed: 1 day ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.