cc-skill-security-review

This skill ensures all code follows security best practices and identifies potential vulnerabilities. Use when implementing authentication or authorization, handling user input or file uploads, or creating new API endpoints.

Quality

63%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/cc-skill-security-review/SKILL.md

Quality

Content

57%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a thorough, code-rich security reference with strong actionability, but it is long and redundant, lacks an explicit sequenced review workflow with checkpoints, and inlines everything in one file rather than using progressive disclosure.

Suggestions

Add an explicit numbered workflow at the top (e.g. 1. gather context, 2. walk each checklist category, 3. validate findings, 4. report with severity) with a validation checkpoint before reporting, to lift workflow_clarity above 3.

Move the long per-category code examples and the pre-deployment checklist into reference files (e.g. references/CHECKLIST.md, references/EXAMPLES.md) and keep SKILL.md as a lean overview with one-level-deep links, to improve both conciseness and progressive_disclosure.

Remove the redundant opening line that restates the description and de-duplicate the per-section verification steps against the final checklist.

Dimension	Reasoning	Score
Conciseness	The body avoids lecturing on concepts Claude already knows, but at ~497 lines it is padded by redundancy — the opening restates the description verbatim and the 'Pre-Deployment Security Checklist' repeats the per-section verification steps — so it could be tightened rather than earning a 4.	3 / 5
Actionability	Provides concrete, copy-paste-ready code across nearly every category (Zod schemas, parameterized queries, httpOnly cookies, DOMPurify, CSRF, rate limiting, RLS, npm audit), but minor gaps like the Solana `verify` import/usage and loose `Transaction` typing keep it just below fully executable 5.	4 / 5
Workflow Clarity	Content is organized by topic with per-section verification checklists and a final pre-deployment list, but there is no explicitly sequenced review workflow with validation checkpoints and feedback loops — the process is implicit, matching the 'steps listed but checkpoints missing or implicit' anchor.	3 / 5
Progressive Disclosure	There are no bundle files and the entire reference is a single monolithic SKILL.md with well-headed sections but no internal references to deeper material; content that would benefit from separate files (e.g. the full pre-deployment checklist, the blockchain section) is inlined, fitting the 'some structure but content that should be separate is inline' anchor.	3 / 5
	Total	13 / 20 Passed

Description

70%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is solid: third-person voice, explicit what-and-when, and several concrete trigger terms. Its main weakness is a slightly generic 'what' clause and incomplete coverage of natural security synonyms.

Suggestions

Tighten the 'what' clause by naming concrete actions, e.g. 'Scans code for injection flaws, auth bypasses, and leaked secrets; validates input handling and access controls.'

Add a few more natural trigger terms users actually say, such as 'secrets', 'XSS', 'CSRF', 'vulnerability', or 'security review/audit'.

Consider whether 'all code follows security best practices' is too broad — narrowing to 'web application security review' would reduce overlap with general linting/review skills.

Dimension	Reasoning	Score
Specificity	Names the security domain and two concrete actions ('ensures all code follows security best practices' and 'identifies potential vulnerabilities'), but the first action is broad rather than enumerating specific scanning behaviors, so it is not comprehensive enough for a 4.	3 / 5
Completeness	Explicitly states both what ('ensures all code follows security best practices and identifies potential vulnerabilities') and when ('Use when implementing authentication or authorization, handling user input or file uploads, or creating new API endpoints') with concrete trigger phrases, but the 'what' is slightly generic/broad so it falls just short of the fully precise 5 anchor.	4 / 5
Trigger Term Quality	Includes natural terms a user would say — 'authentication', 'authorization', 'user input', 'file uploads', 'API endpoints' — giving good coverage, though common synonyms like 'secrets', 'XSS', 'vulnerability scan', or 'penetration testing' are missing, keeping it below 5.	4 / 5
Distinctiveness Conflict Risk	The security-review framing plus specific triggers carves a mostly distinct niche with only minor overlap risk against a general code-review skill, but the broad 'all code follows security best practices' phrasing leaves some conflict risk, so not a 5.	4 / 5
	Total	15 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (505 lines); consider splitting into references/ and linking	Warning
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	14 / 16 Passed

Repository: sickn33/antigravity-awesome-skills
Path: skills/cc-skill-security-review/SKILL.md
Commit: 1f67c44

Reviewed: about 15 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.