Skill Crossroads — security-threat-analyst

Skill Crossroads security-threat-analyst
rubric v1.2 · deterministic

overall

Correctness & Structure 100 pass

Triggering & Discoverability 100 pass

Clarity & Instructions 100 pass

Token & Context Cost 60 1 fail

Safety & Security 81 2 warn

Verifiability & Maintainability not yet scored

Top fixes — ranked by score impact

✗ TOKEN-03 Description budget footprint

security-threat-analyst.md:1description 1828 chars → over the ~1536-char listing cap

Description is 1828 chars (~610 tokens) — beyond the ~1536-char cap, so it risks truncation or being dropped from the budget.

Fix Trim the description to the essential trigger phrases; keep it well under 1,536 chars.

⚠ SAFETY-03 No destructive auto-invocation

security-threat-analyst.md:25auto-invocable (no disable-model-invocation) → performs a destructive action ("deploying")

Skill appears to "deploying" but the model can auto-invoke it — a destructive action could fire without the user asking.

deploying

Fix If this action is destructive/irreversible, set `disable-model-invocation: true` so it only runs when explicitly invoked.

⚠ SAFETY-02 allowed-tools least-privilege

security-threat-analyst.md:1no `tools` declared → the agent inherits every tool, including Bash

Subagents without a `tools` list get unrestricted tool access.

Fix Declare a scoped `tools:` list with only what the agent needs (e.g. `tools: Read, Grep, Glob`).

Partial grade — some applicable rubric categories were not scored on this scan (e.g. LLM-assisted checks without a key) and are excluded from the overall.

Embed this badge

Always-fresh — it re-scans and updates on its own.

[![Skill Crossroads](https://skillcrossroads.com/api/badge/NicholasSpisak/claude-code-subagents/agents/core/security-threat-analyst.md.svg)](https://skillcrossroads.com/s/NicholasSpisak/claude-code-subagents/agents/core/security-threat-analyst.md)

Grade your own Claude Code skill — evidence-cited, file-and-line, free. Scan your own skill →