code-audit

Use for authorized source-code security review and SAST workflows including Semgrep, CodeQL patterns, dangerous API hunting, and fix verification.

Quality

92%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

85%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, token-efficient audit skill with clear sequencing, a mandatory verification checkpoint, and proper one-level-deep reference disclosure. Its weakest point is actionability, where several workflow steps remain checklist descriptions rather than concrete executable guidance.

Suggestions

Add concrete executable detail to the verification step — e.g., a sample semgrep findings-review command or a one-line data-flow taint check — instead of a pure checkbox list.

Give a concrete output template (a minimal Finding JSON/markdown shape with location, data-flow, PoC, and fix fields) rather than only describing the fields to include.

Show how to run a fix-verification loop after remediation (e.g., re-running semgrep on the patched diff and confirming the finding clears), which would also strengthen workflow_clarity's feedback-loop aspect.

Dimension	Reasoning	Score
Conciseness	Lean checklist-style body with no padding and no explanation of concepts Claude already knows (e.g., what SAST or Semgrep is); every section earns its place, though the routing-context block adds minor overhead.	3 / 3
Actionability	Provides copy-paste executable commands ('semgrep --config auto .', 'semgrep --config p/owasp-top-ten .') and a concrete checklist file, but the threat-modeling, human-verification, and output steps are described as checklist guidance rather than fully executable instructions.	2 / 3
Workflow Clarity	Clear NOW/NEXT/ACT sequencing plus a numbered 4-step workflow with an explicit mandatory '人工验证 (MUST)' checkpoint and a final '任务完成自检' completion checklist, satisfying the sequence-with-validation anchor.	3 / 3
Progressive Disclosure	Concise overview body that cleanly signals a one-level-deep reference ('references/sast-review-checklist.md', verified to exist) under 参考, with content appropriately split rather than a monolithic wall of text.	3 / 3
	Total	11 / 12 Passed

Description

100%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, concise description that states what the skill does and when to use it with concrete tool names and an explicit trigger clause. It is distinctive and unlikely to conflict with sibling security skills.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'source-code security review', 'SAST workflows including Semgrep, CodeQL patterns, dangerous API hunting, and fix verification' — matching the multi-action anchor rather than the vague or domain-only anchors.	3 / 3
Completeness	Opens with an explicit 'Use for ...' trigger clause (when) and enumerates concrete capabilities (what), so both halves are explicitly present; not capped at 2 because trigger guidance is not missing.	3 / 3
Trigger Term Quality	Natural terms users would say are well covered: 'security review', 'SAST', 'Semgrep', 'CodeQL', 'dangerous API hunting', 'fix verification'; not just jargon, and matches the good-coverage anchor.	3 / 3
Distinctiveness Conflict Risk	Clear niche — authorized source-code SAST with named tools — that is unlikely to trigger the wrong skill; the body even partitions it from supply-chain, api, and llm security skills.	3 / 3
	Total	12 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: zhaoxuya520/reverse-skill
Path: skills/code-audit/SKILL.md
Commit: 6aa1362

Reviewed: 7 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.