code-vuln-audit

Scan code for security issues: dependency vulnerabilities (npm/pip audit), secret leaks (regex and entropy analysis), and OWASP anti-patterns like SQL injection, XSS, or command injection. Use when the user mentions security scans, vulnerability detection, secret leaks, API keys, OWASP, npm audit, pip-audit, hardcoded passwords, or code security checks.

Quality

91%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

High

Do not use without reviewing

Quality

Content

82%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is a well-structured, executable reference for a CLI security scanner with concrete commands and clear parameter/output documentation. It is strong on actionability and reasonably lean, with minor room to tighten output examples and add post-scan triage guidance.

Suggestions

Trim the full text-output and JSON-output example blocks to minimal representative snippets to improve token efficiency.

Add a short 'Interpreting results' note describing how to triage findings by severity and exit code after a scan.

Consider moving the detailed secret-type and OWASP detection-pattern tables into a reference file, keeping only a summary in SKILL.md.

Dimension	Reasoning	Score
Conciseness	The body is efficient and uses compact tables for parameters, scan modules, and exit codes without explaining concepts Claude already knows, though the full text and JSON output examples are somewhat verbose and could be trimmed slightly.	4 / 5
Actionability	Quick Start provides copy-paste-ready executable commands ('python3 scripts/security_scan.py --mode deps .'), and the Parameters table gives concrete defaults, making the guidance fully executable across common cases.	5 / 5
Workflow Clarity	As a simple single-purpose CLI skill the core action is unambiguous and exit codes (0/1/2) provide a built-in feedback signal, but there is no explicit guidance on triaging or verifying findings after a scan.	4 / 5
Progressive Disclosure	Sections are well-organized (Quick Start, Scan Module Details, Parameters, Output Format, Exit Codes, Prerequisites) and the single bundle file scripts/security_scan.py is clearly referenced one level deep, though the detailed secret-type and OWASP tables are inlined rather than split into reference files.	4 / 5
	Total	17 / 20 Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is exemplary: third-person, concise, and concrete, with a clear what/when structure and rich natural trigger terms. It directly matches the top anchors on every dimension.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions across three distinct capabilities — 'dependency vulnerabilities (npm/pip audit)', 'secret leaks (regex and entropy analysis)', and 'OWASP anti-patterns like SQL injection, XSS, or command injection' — giving comprehensive, specific coverage rather than vague language.	5 / 5
Completeness	It explicitly answers both 'what' (the three scanning capabilities) and 'when' via a concrete 'Use when the user mentions...' trigger clause, matching the anchor for clear and explicit what-and-when with trigger phrases.	5 / 5
Trigger Term Quality	The 'Use when...' clause covers natural user phrasings including synonyms ('security scans', 'vulnerability detection', 'code security checks') and concrete tooling terms ('API keys', 'OWASP', 'npm audit', 'pip-audit', 'hardcoded passwords').	5 / 5
Distinctiveness Conflict Risk	The security-scanning niche with specific triggers (OWASP, npm audit, secret leaks) is clearly distinct from other skills and unlikely to fire for unrelated tasks; conflict risk is minimal.	5 / 5
	Total	20 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: zebbern/claude-code-guide
Path: skills/code-vuln-audit/SKILL.md
Commit: 4eaf4ff

Reviewed: 4 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.