code-vuln-audit

Scan code for security issues: dependency vulnerabilities (npm/pip audit), secret leaks (regex and entropy analysis), and OWASP anti-patterns like SQL injection, XSS, or command injection. Use when the user mentions security scans, vulnerability detection, secret leaks, API keys, OWASP, npm audit, pip-audit, hardcoded passwords, or code security checks.

Quality

93%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

High

Do not use without reviewing

Quality

Content

87%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a concise, highly actionable reference for a single-tool skill with clean section structure and an appropriately split one-level-deep script reference. Its main gap is the absence of explicit verification guidance for triaging scan findings.

Suggestions

Add a short 'Triage / verifying findings' section giving guidance on confirming or dismissing likely false positives before reporting results, which would raise workflow_clarity.

Note the severity-based response expectation (e.g., treat 'critical'/'high' findings as needing immediate review) to add an explicit checkpoint after the scan runs.

Clarify that exit code 1 should be interpreted and acted on (e.g., report findings and suggest fixes) so the post-scan step is unambiguous.

Dimension	Reasoning	Score
Conciseness	The body is a lean, structured reference (parameter/exit-code/pattern tables) that avoids explaining concepts Claude already knows such as what SQL injection or XSS are; every section is operationally relevant rather than padded.	3 / 3
Actionability	Quick Start provides copy-paste executable commands (e.g. 'python3 scripts/security_scan.py --mode deps .') alongside a complete parameter table with defaults and exit codes, making guidance fully executable and copy-paste ready.	3 / 3
Workflow Clarity	Invocation is clear and exit codes provide result feedback, but as a batch scan it lacks explicit verification/validation guidance for findings such as false-positive triage or severity-based response, capping it at the steps-present-but-checkpoints-implicit level.	2 / 3
Progressive Disclosure	The body is a well-organized overview split into clearly labeled sections with implementation offloaded to a single one-level-deep referenced bundle file (scripts/security_scan.py) that exists, matching the clear-overview-with-one-level-deep-references anchor.	3 / 3
	Total	11 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, trigger-rich, and explicitly answers both what the skill does and when to use it in third person, with minimal conflict risk. It is a strong example of a well-formed skill description.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'dependency vulnerabilities (npm/pip audit)', 'secret leaks (regex and entropy analysis)', and 'OWASP anti-patterns like SQL injection, XSS, or command injection' — matching the anchor for multiple specific concrete actions rather than just naming a domain.	3 / 3
Completeness	Explicitly answers both what (the three scan capabilities) and when via the 'Use when the user mentions security scans, vulnerability detection, secret leaks, API keys, OWASP, npm audit, pip-audit, hardcoded passwords, or code security checks' trigger clause.	3 / 3
Trigger Term Quality	Covers natural user language plus tool names — 'security scans, vulnerability detection, secret leaks, API keys, OWASP, npm audit, pip-audit, hardcoded passwords, or code security checks' — giving good coverage of terms a user would actually say.	3 / 3
Distinctiveness Conflict Risk	Occupies a clear niche (dependency auditing, secret detection, OWASP patterns) with specialized triggers unlikely to fire for unrelated skills, matching the distinct-triggers anchor.	3 / 3
	Total	12 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: zebbern/claude-code-guide
Path: skills/code-vuln-audit/SKILL.md
Commit: af7d491

Reviewed: about 9 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.