review-security

Use when reviewing a branch diff for security concerns — auth, tokens and sessions, injection, secrets, cookies, CSP and third-party content — and reporting findings with S-C/H/M/L IDs in the four-field format.

Quality

92%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

85%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-sequenced review skill with strong validation feedback loops and clean one-level-deep reference structure. Its main weakness is conciseness: the report-shape discipline is argued repeatedly and rhetorically across several sections where tighter, more uniform wording would hold the same discipline for fewer tokens.

Suggestions

Consolidate the report-shape enforcement into one canonical section and reference it from Step 0/Step 2/Finding format/Report shape, rather than restating the rationale and the 'clobbered skeleton fails the run' warning each time.

Trim the persuasive/rhetorical phrasing ('however good the analysis inside it', 'the worst case in this file', 'costs the review its credibility') into terse imperatives; the discipline survives without the argumentation.

The four-times-repeated `grep -c` validation block could be defined once and invoked by name, with each later mention just naming the check rather than reprinting the command and its 4-expected output.

Dimension	Reasoning	Score
Conciseness	The guidance is mostly operational and task-specific, but the file is long with repeated rhetorical emphasis on the report-shape discipline ('a run that leaves a differently-shaped file has produced nothing', 'the worst case in this file') restated across Step 0, Step 2, Finding format and Report shape — noticeable over-explanation that could be tightened, fitting the 'mostly efficient but some unnecessary explanation' anchor rather than the lean 4.	3 / 5
Actionability	Provides copy-paste-ready bash (the SECURITY-REVIEW.md skeleton, git diff base resolution, the routing grep table, the `grep -c` validation) plus concrete per-bullet checklists and an exact finding structure, covering the common cases fully executably.	5 / 5
Workflow Clarity	Clear sequence (Step 0 skeleton → Step 1 route → Step 2 work bullets → final shape check) with explicit validation checkpoints (`grep -c` must print 4) run both mid-run and at the end, plus a restore-and-retry feedback loop when the check fails.	5 / 5
Progressive Disclosure	SKILL.md is an overview holding the always-run sections and routing table, with the nine scenario-specific checklists clearly split to `references/checklists.md` and the long-tail compliance classes to `references/compliance.md` — both verified real files — at one level deep with explicit 'open this file when Step 1 routes here' navigation.	5 / 5
	Total	18 / 20 Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is a strong, concise trigger phrase that states both what the skill does and when to use it, enumerates concrete security domains, and names the output format. It hits the top anchor on every dimension with no fluff or over-claims.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — reviewing a branch diff for specific security domains (auth, tokens and sessions, injection, secrets, cookies, CSP, third-party content) and reporting findings with S-C/H/M/L IDs in a four-field format — giving comprehensive coverage rather than the minor-gaps case at 4.	5 / 5
Completeness	Explicitly answers both what ('reviewing a branch diff for security concerns…reporting findings with S-C/H/M/L IDs in the four-field format') and when ('Use when reviewing a branch diff for security concerns'), with concrete trigger phrases, matching the top anchor.	5 / 5
Trigger Term Quality	Includes natural keywords a user would say — 'security', 'auth', 'tokens', 'sessions', 'injection', 'secrets', 'cookies', 'CSP', 'third-party content', 'branch diff' — with synonyms and variations well covered, matching the comprehensive-anchor example.	5 / 5
Distinctiveness Conflict Risk	Occupies a clear niche — security/compliance review of a branch diff with its own S-/C- finding ID scheme — making it unlikely to trigger for a non-security code-review skill; minimal conflict risk.	5 / 5
	Total	20 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: xchromo/osn
Path: .claude/skills/review-security/SKILL.md
Commit: 5438649

Reviewed: 13 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.