CtrlK
BlogDocsLog inGet started
Tessl Logo

arn-code-batch-cve-fix

This skill should be used when the user says "fix CVEs", "patch vulnerabilities", "apply security patches", "resolve security advisories", "batch CVE fix", "patch dependencies", "fix security findings", "remediate CVEs", "apply CVE fixes", "batch fix vulnerabilities", "resolve vulnerability tickets", "arness CVE fix", "arn-code-batch-cve-fix", "fix all open CVE tickets", "cleanup resolved CVE proposals", or wants Arness to apply per-group dependency bumps for previously-triaged CVEs and open per-group pull requests that close their corresponding sub-issues. Reuses arn-code-batch-implement worker isolation verbatim, opens PRs targeting the configured Security branch, and offers an interactive post-merge cleanup of fully-resolved past CVE proposals. Interactive only — no proposal mode, no headless write path; every PR is human-reviewed and every archive move is confirmed via AskUserQuestion. Requires that arn-code-batch-cve-scan has produced triage records and sub-issues.

72

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

81%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a well-structured, validation-rich sequencer that keeps procedural detail in clearly signaled reference files and provides concrete commands inline. Its main weakness is moderate repetition of the interactive-only and auto-apply constraints across steps.

Suggestions

State the interactive-only and auto-apply-boundary constraints once in the overview and reference them by anchor from later steps rather than re-explaining them in Steps 3, 4, 5, and 7.

Consolidate the 'Security branch is used in THREE places' enumeration so it lives in one location instead of being re-listed across Step 0, Step 3, and Step 4.

DimensionReasoningScore

Conciseness

Mostly efficient with concrete commands and delegated detail, but the interactive-only constraint, the auto-apply boundary, and the 'three places the Security branch is used' enumeration are repeated across Steps 0, 3, 4, 5, and 7 and could be tightened.

4 / 5

Actionability

Provides concrete executable commands ('gh issue view <N> --json state', 'git worktree add <path> <security-branch>', 'gh pr create --base <security-branch>', 'git symbolic-ref --short refs/remotes/origin/HEAD') with minor gaps where the actual fix/verification execution is delegated to reference files.

4 / 5

Workflow Clarity

A batch operation with a clearly sequenced Step 0–8 pipeline, explicit STOP conditions, an AskUserQuestion pre-flight gate, an auto-apply 5-condition AND-gate, verification, and a two-axis evidence gate for cleanup — validation checkpoints and feedback loops are present throughout, so the batch cap does not apply.

5 / 5

Progressive Disclosure

SKILL.md is a lean overview that points to one-level-deep, clearly signaled references (grouping.md, auto-apply-boundary.md, worker-instructions.md, verification.md, pr-body.md, cleanup-resolved.md), all of which exist in ./references/, with navigation easy to follow.

5 / 5

Total

18

/

20

Passed

Description

95%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is highly complete and distinctive, pairing concrete capabilities with an extensive set of natural trigger phrases and an explicit 'use when' clause. Its only weakness is verbosity — the single long paragraph bundles in architectural constraints and preconditions that slightly pad the core statement.

Suggestions

Tighten the description into a shorter lead sentence (what + when) and move the architectural/precondition details (interactive-only, worker-isolation reuse, requires arn-code-batch-cve-scan) into the body, since they pad the frontmatter without adding trigger value.

Remove the malformed trigger term 'arness CVE fix' (typo) and the bare skill-name token 'arn-code-batch-cve-fix' as trigger phrases — users do not naturally say the skill's own slug.

DimensionReasoningScore

Specificity

Lists several concrete actions ('apply per-group dependency bumps', 'open per-group pull requests that close their corresponding sub-issues', 'interactive post-merge cleanup of fully-resolved past CVE proposals'), with only minor gaps in coverage relative to a fully comprehensive enumeration.

4 / 5

Completeness

Explicitly answers both what the skill does (per-group dependency bumps, per-group PRs, archive cleanup) and when to use it, opening with 'This skill should be used when the user says ...' and listing concrete trigger phrases.

5 / 5

Trigger Term Quality

Comprehensive coverage of natural trigger phrases including synonyms ('fix CVEs', 'patch vulnerabilities', 'apply security patches', 'resolve security advisories', 'remediate CVEs', 'batch fix vulnerabilities', 'fix all open CVE tickets') that users would naturally say.

5 / 5

Distinctiveness Conflict Risk

Occupies a clear niche (post-triage batch CVE fix requiring arn-code-batch-cve-scan output) with CVE-specific triggers, minimal overlap risk with sibling skills.

5 / 5

Total

19

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
AppsVortex/arness
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.