CtrlK
BlogDocsLog inGet started
Tessl Logo

talk-tal-skills-security

Use when the user asks about Liran Tal's talk at AI Native DevCon on skills security — including questions about the lethal trifecta / toxic flows, the Snyk research finding ~30% of ~4,000 Glow skills had security issues, malicious skill examples (SkillGuard, fake Vercel deployment skill, "buy anything", invisible-character Trojan Source skills), the confused-deputy problem, acceptance fatigue, parallels to NPM supply-chain attacks, or how to think about reviewing and sandboxing AI agent skills.

71

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

The canonical home for this skill is ainativedev/aidevcon-2026-ldn

SKILL.md
Quality
Evals
Security

Quality

Content

77%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

This is a well-structured, highly actionable skill for handling questions about a specific conference talk. Its greatest strengths are the clear multi-step workflows with explicit validation checkpoints and the concrete guidance for each use case. Its main weaknesses are moderate repetition across sections (the verbatim-quote and file-consultation instructions are restated nearly identically five times) and the inability to verify referenced bundle files.

Suggestions

Consolidate the repeated 'read outline.md → read transcript.md → quote verbatim → cite line numbers → say if not found' pattern into a single 'General procedure' section, then have each use-case section reference it and add only its unique steps.

Provide the referenced bundle files (outline.md, transcript.md, quotes.md) or at minimum a file listing so the progressive disclosure structure can be fully validated.

DimensionReasoningScore

Conciseness

The skill is moderately efficient — it provides structured, non-trivial instructions for handling a specific talk's content. However, some sections are repetitive (e.g., the 'verbatim quote' instruction is restated in nearly every section, and the step-by-step patterns across the five use-case sections share significant overlap that could be consolidated).

2 / 3

Actionability

The skill provides highly concrete, step-by-step guidance for each use case (factual Q&A, auditing, applying frameworks, teaching concepts, proactive surfacing). Each workflow specifies exactly which files to consult, in what order, and what output format to use (verbatim quotes, line citations, explicit disclaimers for outside knowledge). This is copy-paste-ready procedural guidance.

3 / 3

Workflow Clarity

Each use case has a clearly sequenced workflow with explicit validation checkpoints — e.g., 'read outline.md first to locate the section, then read transcript.md,' 'if the framework doesn't fit, say so,' 'if a claim isn't in the transcript, say the talk doesn't address this.' The audit workflow explicitly requires walking through every dimension in order and asking the user before scoring unknown dimensions. These are well-defined feedback loops.

3 / 3

Progressive Disclosure

The skill references external files (outline.md, transcript.md, quotes.md) appropriately and signals when to use each. However, no bundle files were provided, making it impossible to verify the references resolve correctly. The SKILL.md itself is somewhat long and could benefit from splitting the five use-case sections into a separate reference file, keeping the main skill leaner with just the grounding rules and a navigation table.

2 / 3

Total

10

/

12

Passed

Description

100%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

This is a strong, well-crafted description that clearly identifies a narrow knowledge domain (a specific conference talk on skills security) with explicit trigger guidance and rich, specific terminology. It opens with a clear 'Use when' clause and enumerates numerous concrete topics that serve as natural trigger terms. The only minor concern is its length, but the specificity and completeness justify it.

DimensionReasoningScore

Specificity

The description lists multiple specific concrete topics: lethal trifecta/toxic flows, Snyk research statistics (~30% of ~4,000 Glow skills), specific malicious skill examples (SkillGuard, fake Vercel deployment, 'buy anything', Trojan Source), confused-deputy problem, acceptance fatigue, NPM supply-chain parallels, and reviewing/sandboxing guidance.

3 / 3

Completeness

The description explicitly answers both 'what' (information about Liran Tal's talk on skills security, covering specific topics) and 'when' ('Use when the user asks about...' with a comprehensive list of trigger scenarios). The 'Use when' clause is the opening phrase.

3 / 3

Trigger Term Quality

Excellent coverage of natural terms a user would say: 'Liran Tal', 'AI Native DevCon', 'skills security', 'lethal trifecta', 'toxic flows', 'Snyk', 'Glow skills', 'SkillGuard', 'confused-deputy', 'acceptance fatigue', 'NPM supply-chain attacks', 'sandboxing AI agent skills'. These are highly specific and natural search terms.

3 / 3

Distinctiveness Conflict Risk

Extremely distinctive — it targets a specific talk by a named speaker at a named conference, with highly specific concepts like 'lethal trifecta', 'SkillGuard', 'Trojan Source skills', and exact research statistics. This is unlikely to conflict with any other skill.

3 / 3

Total

12

/

12

Passed

Validation

81%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation9 / 11 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

metadata_field

'metadata' should map string keys to string values

Warning

Total

9

/

11

Passed

Repository
AINativeDev/aidevcon-2026-ldn
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.