Content
86%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A well-structured, highly actionable skill: executable commands at every step, a clean spine-plus-reference split, and an unusually strong anti-patterns/limitations treatment. The gaps are minor — slight over-explanation in the Overview and no explicit validation checkpoint for the silent empty-database failure mode the skill itself warns about.
Suggestions
Trim the Overview's explanation of what CodeQL and SARIF are (Claude already knows); keep only the database-then-query framing and the cross-file taint example that justifies when to use it.
Add an explicit validation checkpoint after Step 2, e.g. a smoke query or database inspection, since the anti-patterns table notes that a missed --command produces a silently empty database.
Cut the redundant Step 4 prose ('persistent + auditable + show in the audit log') that restates the dismissal row in the triage table.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is mostly lean — tables, terse steps, copy-paste commands — but the Overview re-explains what CodeQL and SARIF are ("CodeQL is GitHub's semantic-analysis SAST: build a database... emit SARIF"), and Step 4 prose ("persistent + auditable + show in the audit log") repeats the table row above it. This is the 'efficient with minor instances of over-explanation' anchor rather than the fully lean 5. | 4 / 5 |
Actionability | Every step ships executable, copy-paste-ready commands: the curl/unzip install with PATH export, `codeql --version` verification, per-language `database create` invocations for both interpreted and compiled builds, the `database analyze` SARIF command, a runnable jq SARIF filter, a complete inline suppression template, and `--threads`/`--ram` flags. Coverage of the common cases is complete, matching the 5 anchor. | 5 / 5 |
Workflow Clarity | Steps 1–5 are clearly sequenced and include checkpoints (`codeql --version` verify, quarterly dismissed-alerts review), landing on the 'clear sequence with most checkpoints' anchor. It is not 5 because the skill itself documents that a missing `--command` yields a silently empty database, yet no explicit post-create validation (e.g., a smoke query or database check) is built into the workflow. | 4 / 5 |
Progressive Disclosure | SKILL.md is a concise spine, and Step 3 points to a single, clearly-signaled, one-level-deep reference (references/codeql-reference.md, verified to exist) while explicitly enumerating what it contains (pack list, suites, custom .ql example, CI integration). The reference file does not nest further, matching the 5 anchor for well-signaled one-level-deep references. | 5 / 5 |
Total | 18 / 20 Passed |