Content
85%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The body is highly actionable with a clear, validated multi-step workflow and clean progressive disclosure to a single reference file. Its main weakness is conciseness: it restates CodeQL fundamentals and carries conceptual padding that Claude already knows.
Suggestions
Cut the 'Overview' paragraph that re-explains what CodeQL is and why database-then-query matters — Claude already knows this; keep only the operational model.
Tighten the 'When to use' bullets and 'Limitations' list, which partly restate concepts rather than instruct action.
Move the long inline SARIF jq one-liner and justification template detail into the reference file to reduce body token weight.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | Mostly efficient with executable commands throughout, but it explains CodeQL basics Claude already knows ('CodeQL is GitHub's semantic-analysis SAST: build a database...') and the overview/when-to-use/limitations sections pad the body with conceptual context that could be trimmed. | 2 / 3 |
Actionability | Fully executable commands at every step — install curl/unzip, database create with language and build commands, database analyze with --format=sarif, performance flags --threads/--ram, and a concrete FP-suppression template — copy-paste ready. | 3 / 3 |
Workflow Clarity | Five clearly sequenced steps with a mandatory FP-triage section, explicit 'MUST wrap the build' guidance, an anti-patterns table mapping failure to fix, and a quarterly review cadence forming a validation/feedback loop. | 3 / 3 |
Progressive Disclosure | The SKILL.md spine keeps the core create/analyze/triage path and clearly signals one-level-deep detail in references/codeql-reference.md, which holds the pack list, custom .ql example, and CI integration — well split and easy to navigate. | 3 / 3 |
Total | 11 / 12 Passed |