CtrlK
BlogDocsLog inGet started
Tessl Logo

nicholasjackson/opa-rego-language

Rego is the declarative policy language used by Open Policy Agent (OPA). This tile covers writing and testing Rego policies for Kubernetes admission control, Terraform and infrastructure-as-code plan validation, Docker container authorization, HTTP API authorization, RBAC and role-based access control, data filtering, metadata annotations with opa inspect, and OPA policy testing with opa test.

96

1.18x
Quality

94%

Does it follow best practices?

Impact

97%

1.18x

Average score across 32 eval scenarios

SecuritybySnyk

Low

Low-risk findings worth noting

Overview
Quality
Evals
Security
Files

Quality

Content

92%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is an exemplary lean progressive-disclosure index that offloads detail to 18 well-organized, verified reference files with concrete pattern hints per entry. Its only minor weakness is the absence of any inline worked example, though that is justified by the reference architecture.

Suggestions

Consider including one short inline Rego snippet (e.g. a minimal admission-control deny rule) so users get an immediately actionable example without opening a reference file.

DimensionReasoningScore

Conciseness

The body is a lean index of domain -> pointer lines with no padding and no explanation of concepts Claude already knows; every line earns its place, matching the lean-and-efficient anchor.

5 / 5

Actionability

Each entry names concrete, specific patterns (e.g. 'set subtraction for unknown fields', 'default rule := value tier-based fallbacks') and points to verified worked-example files, but the body itself contains no inline executable code, leaving a minor gap versus copy-paste-ready guidance.

4 / 5

Workflow Clarity

The single instruction — 'Read the file for the domain you're working in before writing policy code' — is unambiguous, and the simple-skill exception applies since no destructive or batch operation requires validation checkpoints.

5 / 5

Progressive Disclosure

A clear overview with well-signaled, one-level-deep references to 18 verified-real files, appropriately split by domain and Regal rule category, with easy navigation matching the clear-overview anchor.

5 / 5

Total

19

/

20

Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is a strong, concrete, and well-triggered summary that clearly distinguishes this skill from general Rego style rules and names six specific domains with worked-example intent. Its only minor gap is missing a few natural synonyms (e.g. .rego extension) in the trigger terms.

Suggestions

Add the .rego file extension and a synonym like 'OPA policies' alongside 'Rego policies' to round out trigger-term coverage.

DimensionReasoningScore

Specificity

Lists six domains with concrete, specific actions (webhook/Gatekeeper policies, plan validation, JWT-authenticated gateway policies, 'set subtraction for unknown fields', 'default rule := value tier-based fallbacks', RBAC/ABAC/SoD, # METADATA/opa inspect, per-rule-category linter compliance) — comprehensive coverage matching the score-5 anchor.

5 / 5

Completeness

Explicitly answers 'what' (reference material for writing Rego/OPA policies in named domains) and 'when' (Load this when rules.md's general Rego style rules aren't enough and you need worked examples), matching the clearly-and-explicitly anchor.

5 / 5

Trigger Term Quality

Strong keyword coverage including 'writing Rego/OPA policies', Kubernetes, Terraform, CloudFormation, RBAC/ABAC, Regal linter; a few natural synonyms and the .rego file extension are missing, so it sits just below the comprehensive anchor-5 example.

4 / 5

Distinctiveness Conflict Risk

Scoped to a distinct Rego/OPA domain-reference niche explicitly contrasted with rules.md, with domain-specific triggers that minimize conflict with other skills.

5 / 5

Total

19

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Reviewed

Table of Contents