code-audit

Use for authorized source-code security review and SAST workflows including Semgrep, CodeQL patterns, dangerous API hunting, and fix verification.

Quality

75%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/code-audit/SKILL.md

Quality

Content

75%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is lean, well-structured, and actionable with concrete semgrep commands, threat-model checklists, an explicit human-verification gate, and a completion self-check. It falls just short of top marks because command coverage across tools is uneven, there is no re-scan feedback loop, and one reference duplicates inline content while others point outside the bundle.

Suggestions

Add copy-paste commands for the other tools in the table (e.g. `codeql database create`, `bandit -r .`, `gosec ./...`) so guidance is fully executable across the listed stack.

Make the validation loop explicit: after '人工验证', state 're-scan with the refined rule set until no new high-confidence findings remain' to add a fix→re-scan feedback loop.

Deduplicate the inline section-3 checklist against references/sast-review-checklist.md (link to it instead of repeating items), and flag the out-of-bundle sibling paths as non-loadable routing hints.

Dimension	Reasoning	Score
Conciseness	The body is terse — short checklists, a compact tool table, and minimal commands — and assumes Claude knows SAST concepts, but the '路由上下文' and '适用场景' routing metadata add a little non-execution overhead, fitting anchor 4 rather than the fully lean anchor 5.	4 / 5
Actionability	Provides copy-paste semgrep commands and concrete verification checklists, but CodeQL/Bandit/gosec appear only as table entries without commands and human verification is checklist-based, so it is 'mostly executable with minor gaps' (anchor 4).	4 / 5
Workflow Clarity	Clear NOW/NEXT/ACT preamble, a numbered 4-step workflow, an explicit '人工验证 (MUST)' checkpoint, and a final '任务完成自检' checklist give a strong sequence, but there is no explicit fix→re-scan feedback loop, capping it at anchor 4 rather than 5.	4 / 5
Progressive Disclosure	Well-sectioned short body with a real one-level reference (references/sast-review-checklist.md, verified present), but that reference partly duplicates the inline checklist and several sibling paths (../field-journal, ../supply-chain-security) point outside the bundle, matching anchor 4.	4 / 5
	Total	16 / 20 Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, trigger-oriented, and clearly niched, with a proper 'Use for' clause and concrete tool/capability names. It stops short of the top anchor because the 'when' guidance restates capabilities rather than listing concrete user-mention scenarios and omits common synonyms.

Suggestions

Add an explicit 'Use when ...' clause naming user-mention scenarios, e.g. 'Use when the user asks for a source-code security audit, SAST scan, or Semgrep/CodeQL triage on an authorized repo.'

Include common synonyms such as 'static analysis', 'code audit', and 'vulnerability scanning' to broaden natural trigger coverage.

Name 1-2 language or output specifics (e.g. 'produces findings with data flow and fix recommendations') to lift specificity toward comprehensive coverage.

Dimension	Reasoning	Score
Specificity	Names the source-code security/SAST domain plus several concrete capabilities ('Semgrep, CodeQL patterns, dangerous API hunting, and fix verification'), but coverage is not fully comprehensive (no languages or output artifacts), matching anchor 4 rather than 5.	4 / 5
Completeness	Provides both a 'what' (the SAST capabilities) and a 'when' ('Use for ...'), but the 'when' restates capabilities rather than enumerating user-mention scenarios, so it does not reach the explicit-trigger-phrase bar of anchor 5.	4 / 5
Trigger Term Quality	Includes natural trigger terms a security user would say ('source-code security review', 'SAST', 'Semgrep', 'CodeQL') with a 'Use for' trigger, but misses common synonyms like 'static analysis', 'code audit', or 'vulnerability scanning', fitting anchor 4.	4 / 5
Distinctiveness Conflict Risk	The 'authorized source-code security review and SAST workflows' framing carves a clear niche distinct from supply-chain or runtime pentest work, with only minor overlap risk against closely related security skills, matching anchor 4.	4 / 5
	Total	16 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: zhaoxuya520/reverse-skill
Path: skills/code-audit/SKILL.md
Commit: 7e2097f

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.