cc-skill-security-review

This skill ensures all code follows security best practices and identifies potential vulnerabilities. Use when implementing authentication or authorization, handling user input or file uploads, or creating new API endpoints.

Quality

66%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/cc-skill-security-review/SKILL.md

Quality

Content

65%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with executable examples and concrete verification checkboxes, but it is a long monolithic reference rather than a sequenced workflow, lacks error-recovery feedback loops, and carries some redundant filler. Splitting topics into referenced files and trimming repetition would raise the lower dimensions.

Suggestions

Move the per-topic detailed code blocks into separate reference files (e.g. SECRETS.md, AUTH.md) and keep SKILL.md as a concise overview with one-level-deep links, improving progressive disclosure and conciseness.

Remove the duplicated generic "When to Use" section and the closing "Remember" exhortation to reduce token bloat.

Reframe the pre-deployment checklist into a sequenced workflow with explicit validate-fix-retry feedback loops rather than a flat checkbox list.

Dimension	Reasoning	Score
Conciseness	The ~490-line body is mostly concrete code that earns its place, but it repeats the description, includes a generic duplicated "When to Use" section ("This skill is applicable to execute the workflow or actions described in the overview") and a filler "Remember" exhortation, so it could be tightened and is not fully lean.	2 / 3
Actionability	Fully executable TypeScript, SQL, and bash examples (zod schemas, parameterized queries, DOMPurify, RLS policies, rate-limit config) plus per-section verification checkboxes are copy-paste ready and concrete.	3 / 3
Workflow Clarity	Content is organized as topical checklists rather than a sequenced multi-step workflow, and lacks error-recovery feedback loops; per the rubric, missing validation/feedback loops for batch or destructive operations caps this at 2 rather than 3.	2 / 3
Progressive Disclosure	No bundle files (references/scripts/assets) exist, so all ~490 lines sit inline in one monolithic file; the topic blocks could be split into separate reference files, and the structure-with-no-split leaves it at 2.	2 / 3
	Total	9 / 12 Passed

Description

67%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description successfully combines a what-statement with an explicit Use-when trigger list, but the capabilities are stated abstractly and the breadth risks overlap with general review skills. Tightening to concrete actions and adding common security trigger terms would lift the weaker dimensions.

Suggestions

Replace abstract phrasing ("ensures all code follows security best practices") with concrete actions such as "audits code for hardcoded secrets, validates user input, and verifies parameterized queries".

Expand trigger terms to include secrets/credentials, SQL injection, XSS, and CSRF to improve natural-keyword coverage.

Narrow the scope claim to reduce overlap with general code-review skills, e.g. "Conducts a pre-deployment security audit of authentication, input handling, and API endpoints."

Dimension	Reasoning	Score
Specificity	"ensures all code follows security best practices and identifies potential vulnerabilities" names the security domain and one action (identify vulnerabilities) but relies on abstract phrasing rather than listing multiple concrete actions, so it sits at score 2 rather than 3.	2 / 3
Completeness	It answers both what ("ensures all code follows security best practices and identifies potential vulnerabilities") and when ("Use when implementing authentication or authorization..."), with an explicit Use-when clause, meeting the score-3 anchor; it is not capped at 2 because the trigger guidance is present.	3 / 3
Trigger Term Quality	"implementing authentication or authorization, handling user input or file uploads, or creating new API endpoints" are natural triggers, but coverage misses common variations like secrets, credentials, SQL injection, or XSS, keeping it below 3.	2 / 3
Distinctiveness Conflict Risk	The broad framing "all code follows security best practices" could overlap with general code-review skills, though the trigger list narrows the niche, so it is somewhat specific but not yet a clearly distinct niche.	2 / 3
	Total	9 / 12 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (505 lines); consider splitting into references/ and linking	Warning
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	14 / 16 Passed

Repository: sickn33/antigravity-awesome-skills
Path: skills/cc-skill-security-review/SKILL.md
Commit: a3068b7

Reviewed: about 14 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.