Content
86%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A well-structured, highly actionable skill body: sequenced steps with concrete executable commands, a real one-level-deep reference split, and useful anti-patterns and limitations sections. The only notable gaps are minor token overhead from repeated citation prefixes and the absence of an explicit error-recovery loop after validation steps.
Suggestions
Consolidate the repeated 'Per [sg-quick]/[sg-cli]' citation prefixes (they appear ~6 times) into the existing References section or a single provenance note to reclaim tokens without losing traceability.
Add a brief error-recovery step after validation (e.g., 'if semgrep validate fails, fix the pattern syntax and re-run; exit codes 4/5/7 indicate rule/config errors per the reference') to close the feedback loop in the workflow.
In Step 4, state what happens when the baseline scan finds new findings (failing exit code 1 blocks the PR) so the gating behavior is explicit at the point of use rather than only in Step 6.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is dense and assumes reader competence (no explanation of what SAST is), but the 'Per [sg-quick]/[sg-cli]' citation prefix repeats roughly six times and adds minor token overhead that could be trimmed. It is above 3 because there is no padded or unnecessary explanatory section, and short of 5 because of the repeated citation scaffolding. | 4 / 5 |
Actionability | Fully executable throughout: install commands per platform, scan commands with named rulesets, a complete custom-rule YAML example, 'semgrep validate --config .semgrep.yml', a copy-paste GitHub Actions workflow with SARIF upload, and an inline nosemgrep justification template. Commands cover the common cases end to end, matching the top anchor. | 5 / 5 |
Workflow Clarity | Steps 1–6 are clearly sequenced with explicit validation checkpoints ('semgrep validate --config .semgrep.yml', exit-code gating 0/1/2, quarterly suppression audits). It is not 5 because there is no explicit error-recovery feedback loop (e.g., what to do when rule validation fails or how to iterate on findings). | 4 / 5 |
Progressive Disclosure | The spine keeps common commands while the exhaustive output-format, performance-flag, and exit-code tables are split into references/cli-reference.md, which exists and matches exactly what Step 6 promises. The reference is one level deep and clearly signaled in both Step 6 and the References section, with the external doc links collected at the end for easy navigation. | 5 / 5 |
Total | 18 / 20 Passed |