skills/skill-reviewer/SKILL.md
Reviews skills against vendor-aware best practices, emphasizing portability, progressive disclosure, determinism, and local-model fitness. Use when auditing or updating skill files or directories before baselining or publication.
npx skillsauth add igbuend/grimbard skill-reviewerInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
name: skill-reviewer description: Reviews skills against vendor-aware best practices, emphasizing portability, progressive disclosure, determinism, and local-model fitness. Use when auditing or updating skill files or directories before baselining or publication. disable-model-invocation: true aliases:
Reviews skills against a vendor-aware baseline normalized for local, smaller models.
Target: $ARGUMENTS (skill file or directory)
Use when:
Rank findings in this order:
SKILL.md.SKILL.md under it and review each one independently before summarizing cross-cutting issues.references/review-rubric.mdreferences/local-first-normalization.mdreferences/vendor-guidance.md when:
Check the skill against these questions:
SKILL.md concise enough to justify its token cost?Use these labels when applicable:
vendor_overfitfrontier_model_assumptioncontext_budget_riskmissing_progressive_disclosureshould_be_scriptmissing_output_contractvariant_bloatlocal_runtime_gap## Skill Review: [skill-name]
### Summary
[1-2 sentences]
### Portable Strengths
- [High-value strength]
### Critical Issues
- [label] [Issue] - Location: [section/line]
### Local-Model Risks
- [Issue] - Impact: [why this hurts smaller/local models]
### Vendor-Overfit Risks
- [Issue] - Vendor: [name] - Why it may not transfer
### Baseline Recommendations
- [Actionable recommendation]
### Scores
- Portability: [1-5] - [brief reason]
- Context Efficiency: [1-5] - [brief reason]
- Determinism: [1-5] - [brief reason]
- Local-Model Fitness: [1-5] - [brief reason]
- Vendor Alignment: [1-5] - [brief reason]
### Overall Assessment
[Pass | Pass with Recommendations | Needs Revision]
### Suggested Diff
```diff
[Only include when high-confidence and useful]
```
development
Security anti-pattern for Cross-Site Scripting vulnerabilities (CWE-79). Use when generating or reviewing code that renders HTML, handles user input in web pages, uses innerHTML/document.write, or builds dynamic web content. Covers Reflected, Stored, and DOM-based XSS. AI code has 86% XSS failure rate.
development
Security anti-pattern for XPath injection vulnerabilities (CWE-643). Use when generating or reviewing code that queries XML documents, constructs XPath expressions, or handles user input in XML operations. Detects unescaped quotes and special characters in XPath queries.
development
Security anti-pattern for weak password hashing (CWE-327, CWE-759). Use when generating or reviewing code that stores or verifies user passwords. Detects use of MD5, SHA1, SHA256 without salt, or missing password hashing entirely. Recommends bcrypt, Argon2, or scrypt.
development
Security anti-pattern for weak encryption (CWE-326, CWE-327). Use when generating or reviewing code that encrypts data, handles encryption keys, or uses cryptographic modes. Detects DES, ECB mode, static IVs, and custom crypto implementations.