security-review

Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.

Quality

77%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/security-review/SKILL.md

The canonical home for this skill is security-review in affaan-m/ECC

Quality

Content

65%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable security reference with strong concrete code and checklists, but it is a long monolithic document whose per-section checklists duplicate the master checklist, lacks a sequenced review workflow with feedback loops, and keeps all detail inline rather than splitting niche topics into reference files.

Suggestions

Deduplicate the checklists: keep one canonical pre-deployment checklist and have per-section 'Verification Steps' reference it (or trim them to only section-specific items) to cut length and redundancy.

Add a short sequenced 'How to run a security review' workflow with a validate → fix → re-check feedback loop, rather than only topic-organized checklists.

Split niche or long-tail content (e.g., the Solana/blockchain section) into a one-level-deep reference file linked from the overview, so the core SKILL.md stays a lean entry point.

Dimension	Reasoning	Score
Conciseness	The body is mostly efficient, concrete code and checklists, but at ~500 lines it carries redundancy — each section's 'Verification Steps' checklist duplicates items in the final 'Pre-Deployment Security Checklist', and the intro/closing lines add mild fluff, so it could be tightened rather than earning the lean-and-efficient anchor.	2 / 3
Actionability	It provides fully executable, copy-paste-ready TypeScript examples and concrete commands ('npm audit', 'npm ci', parameterized queries, httpOnly cookie headers) throughout, matching the anchor for specific, executable guidance.	3 / 3
Workflow Clarity	Verification checklists and a pre-deployment gate provide explicit checkpoints, but there is no sequenced end-to-end security-review workflow or feedback loop (validate → fix → retry), which the top anchor explicitly requires and which matters for destructive/batch operations.	2 / 3
Progressive Disclosure	It is a single well-sectioned ~500-line file with no bundle files or external references; while organization is clear, niche content like the Solana/blockchain section and per-topic details are inline that could be split into one-level-deep reference files, so it sits at the 'some structure, content that should be separate is inline' anchor rather than a monolithic wall of text.	2 / 3
	Total	9 / 12 Passed

Description

90%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description with an explicit 'Use when' trigger and a clear, distinct security niche. The main weakness is the second-person voice, which costs a specificity point, and a slightly vague 'comprehensive...patterns' what-clause.

Dimension	Reasoning	Score
Specificity	The description lists multiple concrete actions ('adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features'), which would normally anchor at 3, but the second-person voice ('Use this skill when...') triggers the required one-point specificity reduction.	2 / 3
Completeness	It explicitly answers both 'when' ('Use this skill when adding authentication...') and 'what' ('Provides comprehensive security checklist and patterns'), satisfying the anchor for clearly answering both with explicit triggers.	3 / 3
Trigger Term Quality	Natural trigger terms users would actually say are well covered — 'authentication', 'secrets', 'API endpoints', 'payment' — matching the anchor for good coverage of terms users would say.	3 / 3
Distinctiveness Conflict Risk	The description is consistently framed around a security niche with security-oriented triggers, making it unlikely to fire for an unrelated skill despite a couple of broadly-phrased triggers like 'handling user input'.	3 / 3
	Total	11 / 12 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (505 lines); consider splitting into references/ and linking	Warning
metadata_version	'metadata.version' is missing	Warning

	Total	14 / 16 Passed

Repository: ysyecust/everything-claude-code
Path: skills/security-review/SKILL.md
Commit: a9cbecb

Reviewed: 1 day ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.