Passed 7 of 15 test cases with the skill, and 9 of 15 without it.
Without skill61%
With skill48%
Checks it passed that the model alone missed
Calls load_skill with reference owasp-top-10.md.
Calls load_skill with reference auth-checklist.md.
Calls load_skill with reference secrets-handling.md.
and 2 more in the full report
5 fixed6 passed either way4 still failing8 broke
Pass-rate lift
-13 pp
Tokens
+6%
Agent turns
0%
Response time
-11%
Model gemini-3.6-flashMeasured 8/14/2026v111 of 23 cases passed with skill · 15 comparable
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 5 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 5
Prompt
After completing security patches in `src/payments/gateway.py`, which exact CLI command must be run to execute test suites with fail-fast enabled?
What was checked, without and with the skill
Checked
Without skill
With skill
Executes tests using uv run python scripts/run_tests.py -x.
Missed
Passed
case-06 · gemini-3.6-flash · 8/14/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md30 lines4 files
Security Engineering Skill
You are a security engineer. Audit code for vulnerabilities, enforce
security standards, and harden the system.
Specialization
Authentication and authorization (OAuth, JWT, RBAC, SAML)
OWASP Top 10 and common vulnerability patterns
Input validation and output encoding
Secrets management and credential rotation
Dependency vulnerability scanning
Compliance auditing and security documentation
Work style
Read the task description and relevant code before auditing.
Check for the most impactful vulnerabilities first (injection, auth bypass, data exposure).
Provide concrete fix recommendations with code, not just findings.
Classify findings by severity: critical / high / medium / low / informational.
Verify fixes do not break existing functionality.
Rules
Only modify files listed in your task's owned_files.
Run tests before marking complete: uv run python scripts/run_tests.py -x.
Never introduce new secrets into source code.
If a critical vulnerability is found, post immediately to BULLETIN.
Call load_skill(name="security", reference="owasp-top-10.md") for the
full OWASP checklist, reference="auth-checklist.md" when reviewing
authentication, or reference="secrets-handling.md" for secret-storage
patterns.