CtrlK
BlogDocsLog inGet started
Tessl Logo

ai-ecoverse/advanced-skills

Quarantined high-risk skills (browser session capture, WebSocket interception) for Slack and Microsoft Teams. Install only after reviewing the security implications.

76

Quality

96%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Low

Low-risk findings worth noting

Overview
Quality
Evals
Security
Files

Quality

Content

92%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A strong, highly actionable command reference: copy-paste-ready examples, explicit validation and error-recovery loops on every risky workflow, and well-signaled one-level-deep references that all exist in the bundle. The only weakness is mild verbosity — Quick-start/per-command duplication and a few over-exampled blocks push it past lean token efficiency.

Suggestions

Trim duplication between the Quick start block and per-command sections (e.g., post/react/watch examples appear twice) — keep one canonical example per command in the Quick start and leave detail to the command sections.

Consider moving the slack-ext user-management command details (status/set-single/set-multi/set-member/add-channel/remove-channel, ~120 lines) into a references file like the eg-* commands do, keeping only the safety policy and quick start inline to cut the SKILL.md body's token footprint.

DimensionReasoningScore

Conciseness

The body is dense with non-obvious, skill-specific knowledge (token extraction from the localConfig_v2 localStorage key, enterprise_is_restricted workarounds, exact-phrase quoting in search, --thread_ts=last state-file semantics) and assumes Claude's competence throughout. It is not 5 because the ~700-line body duplicates several commands between the Quick start and the per-command sections, and a few blocks (auto-sign's four examples, slack find's four sample outputs) could be trimmed without losing coverage.

4 / 5

Actionability

Every command is copy-paste ready with real flags and expected outputs ("slack post C087NCG774J \"Hello channel!\"", "slack search '"AdobeSkills/1.0"' --ws=T06DUTYDQ", jq pipelines, and a one-liner ts capture: ts=$(slack post … | sed -n 's/^ts: //p')), plus concrete gotchas like "The API parameter is channel (singular) — passing channels returns invalid_arguments". Not 4: examples cover the common cases completely with no missing key details.

5 / 5

Workflow Clarity

Multi-step workflows carry explicit validation and feedback loops: the approve/deny sequence ends with "Always verify by re-listing pending requests after acting" and error recovery ("If step 3 still shows the same entry, the action button has expired. Re-trigger the request…"), destructive/batch operations enforce dry-run → --confirm with re-checks, read-backs, and guard flags (--max-members, --min-idle-days, --allow-shared), and the U000000BOGUS0 trick verifies auth without side effects. Not 4: checkpoints are explicit everywhere, satisfying the destructive/batch feedback-loop requirement rather than capping at 3.

5 / 5

Progressive Disclosure

All five referenced files exist (references/endpoints.md, app-manifest.md, enterprise-grid.md, watch-architecture.md, support-portal.md — verified against the bundle), each referenced one level deep and signaled both at point-of-use ("references/watch-architecture.md, 'Auto-watch for replies'") and in a closing References section with per-file descriptions. Not 4: navigation is easy and the split (core commands inline, wire formats and internals in references/) is appropriate with no orphaned or nested references.

5 / 5

Total

19

/

20

Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

An exemplary description: it enumerates the skill's capabilities concretely, includes an explicit "Use when…" clause with natural trigger terms and synonyms, and stays entirely within the Slack niche so mis-triggering risk is minimal. The added slack-ext scope is described concretely rather than as vague fluff.

DimensionReasoningScore

Specificity

The description lists ten-plus concrete actions ("read Slack messages", "post to Slack channels", "add or remove an emoji reaction on any message", "search Slack message text and channels", "find and look up Slack users by name, username, or email", "manage Slack support requests", "watch Slack channels for new messages in real time") covering the skill's full command surface. Not score 4: there are no minor gaps in coverage — every documented capability class is named.

5 / 5

Completeness

Both questions are answered explicitly and concretely: the opening sentence states what the skill does, and "Use when the user wants to check, post, react to, or search Slack messages, add a reaction, get Slack user info, view the Slack activity feed, manage Slack support tickets/help requests, watch a Slack channel for updates, or automate any Slack task" provides the when with concrete triggers. Not score 4: the when-clause is explicit and specific, not merely present.

5 / 5

Trigger Term Quality

"Triggers on mentions of Slack, Slack channels, DMs, threads, or messages, Slackbot, Slack notifications, Slack support or help requests, watching/monitoring a Slack channel, react or emoji reaction, or searching Slack message text" gives comprehensive natural-language coverage with synonyms (support tickets/help requests, watch/monitor). Not score 4: no common natural phrasing is missing.

5 / 5

Distinctiveness Conflict Risk

Every clause is Slack-scoped ("Slack Web API client", "Slackbot", "slack-ext for admin user-management (guest conversion, guest channels)"), giving a clear niche with distinct triggers and minimal overlap risk with other messaging/notification skills. Not score 4: no closely related skill's territory bleeds in — all triggers are Slack-specific.

5 / 5

Total

20

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

skill_md_line_count

SKILL.md is long (723 lines); consider splitting into references/ and linking

Warning

Total

15

/

16

Passed

Reviewed

Table of Contents