review-security-and-privacy

Review a change for what an adversary could do with it, and for what it exposes about people. Use as one lens in a code review run.

Quality

66%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./code-review/skills/review-security-and-privacy/SKILL.md

The canonical home for this skill is tessl/code-review

Quality

Content

86%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

This is a well-crafted, lean skill that clearly defines a security and privacy review lens. Its strengths are exceptional conciseness, clear structure, and a well-defined threshold that prevents over-reporting. The main gap is the absence of a concrete worked example showing a sample finding in the prescribed format, which would elevate actionability to the highest level.

Suggestions

Add one brief worked example showing a finding in the prescribed format (untrusted input → sink → impact → concrete fix) to make the Reporting section fully actionable.

Dimension	Reasoning	Score
Conciseness	Every sentence earns its place. No explanation of what security or privacy means in general terms. No padding. The skill assumes Claude knows how to read diffs, understand trust boundaries, and apply security concepts—it only specifies the lens and method.	5 / 5
Actionability	The guidance is concrete and specific: trace untrusted input to sinks, check what new fields/logs/errors reveal, name the input-sink-impact chain, and state a concrete fix. However, it lacks worked examples (e.g., a sample finding with input/sink/impact/fix) that would make it fully copy-paste actionable.	4 / 5
Workflow Clarity	The workflow is clear: start from boundaries, trace input to sinks, trace data outward, apply the threshold, then report with the specified format. The sequence is logical and the threshold acts as a validation checkpoint (no hypothetical risks). Minor gap: no explicit step for what to do when no findings exist or how to summarize the review.	4 / 5
Progressive Disclosure	This is a short, single-purpose skill under 50 lines with no need for external references. The content is well-organized into clear sections (Scope, Method, Threshold, Reporting) that are easy to navigate and appropriately sized.	5 / 5
	Total	18 / 20 Passed

Description

46%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description communicates a security and privacy-focused code review lens but lacks specificity in concrete actions and natural trigger terms. It has a reasonable completeness structure with both what and when, but the vague language makes it hard to distinguish from other code review skills and difficult for Claude to match against user requests.

Suggestions

Add specific concrete actions like 'identifies injection vulnerabilities, flags PII/personal data exposure, checks for authentication bypasses, reviews access control changes'.

Include natural trigger terms users would say: 'security review', 'vulnerability', 'privacy review', 'threat model', 'attack surface', 'PII', 'sensitive data'.

Make the 'when' clause more explicit with trigger phrases: 'Use when the user asks for a security review, threat assessment, privacy audit of code changes, or wants to identify potential attack vectors in a pull request'.

Dimension	Reasoning	Score
Specificity	Names the domain (security/privacy review of code changes) but actions are minimal and generic - 'review a change' and 'what an adversary could do' are vague without specifying concrete actions like 'identify injection vulnerabilities, flag PII exposure, check authentication bypasses'.	2 / 5
Completeness	Has both 'what' (review changes for adversarial exploitation and privacy exposure) and 'when' ('Use as one lens in a code review run'), though the 'when' is somewhat implicit and could be more explicit about trigger scenarios.	4 / 5
Trigger Term Quality	Contains some relevant terms like 'adversary', 'code review', and 'exposes about people', but misses natural user phrases like 'security review', 'vulnerability', 'privacy', 'threat model', 'attack surface', 'PII', or 'data exposure'.	2 / 5
Distinctiveness Conflict Risk	The security/adversary angle provides some distinction from general code review skills, but 'code review' is broad and could overlap with other review-focused skills. The privacy angle ('what it exposes about people') adds some uniqueness but isn't strongly differentiated.	3 / 5
	Total	11 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 11 / 11 Passed

Validation for skill structure

No warnings or errors.

Repository: tesslio/product-plugins
Path: code-review/skills/review-security-and-privacy/SKILL.md
Commit: 37f0a21

Reviewed: 1 day ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.