CtrlK
BlogDocsLog inGet started
Tessl Logo

code-review

Comprehensive code review covering security, correctness, bash compatibility, test coverage, and code quality. Use for PRs, commits, or any code changes.

61

Quality

72%

Does it follow best practices?

Impact

No eval scenarios have been run

SecuritybySnyk

Advisory

Suggest reviewing before use

Optimize this skill with Tessl

npx tessl skill review --optimize ./.claude/skills/code-review/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Discovery

67%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description adequately communicates its purpose as a code review skill and includes an explicit 'Use for...' clause, which is good for completeness. However, it lists review categories rather than concrete actions, and the inclusion of 'bash compatibility' alongside general code review concerns creates an unclear scope. The trigger terms cover common cases but miss several natural variations users might employ.

Suggestions

Replace category labels with concrete actions, e.g., 'Identifies security vulnerabilities, checks logic correctness, verifies test coverage, and flags code quality issues' instead of just listing categories.

Expand trigger terms to include common variations like 'pull request', 'diff', 'review my code', 'MR', 'merge request', or 'code feedback'.

Clarify the 'bash compatibility' aspect — either remove it if the skill is general-purpose, or explain it more clearly to avoid confusion about the skill's scope.

DimensionReasoningScore

Specificity

Names the domain (code review) and lists several areas of focus (security, correctness, bash compatibility, test coverage, code quality), but these are categories rather than concrete actions. It doesn't specify what actions are performed, like 'identifies vulnerabilities', 'checks for race conditions', or 'suggests test cases'.

2 / 3

Completeness

Clearly answers both 'what' (comprehensive code review covering security, correctness, bash compatibility, test coverage, and code quality) and 'when' ('Use for PRs, commits, or any code changes'). The 'Use for...' clause serves as an explicit trigger guidance.

3 / 3

Trigger Term Quality

Includes some natural keywords like 'code review', 'PRs', 'commits', and 'code changes' that users would say. However, it misses common variations like 'pull request', 'diff', 'review my code', 'code quality check', or 'security audit'. 'Bash compatibility' is a surprisingly narrow trigger term for a general code review skill.

2 / 3

Distinctiveness Conflict Risk

While 'code review' is a recognizable niche, the broad scope covering security, correctness, and code quality could overlap with dedicated security analysis skills, linting skills, or test coverage tools. The mention of 'bash compatibility' adds some distinctiveness but is oddly specific for an otherwise general description.

2 / 3

Total

9

/

12

Passed

Implementation

77%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

This is a highly actionable and well-structured code review skill tailored for a security-critical restricted shell interpreter. Its greatest strengths are the concrete, executable guidance across all review dimensions, the clear severity classification system, and the thorough PR submission workflow with API calls. The main weakness is its length — at ~300 lines with no progressive disclosure to supporting files, it consumes significant context window for every invocation, though the security-critical domain justifies much of the detail.

Suggestions

Consider splitting the PR Review Submission section (steps 0-3 with emoji reactions) into a separate referenced file, as it's a mechanical workflow distinct from the review logic itself.

The Pentest Checklist and Finding Severity sections could be extracted into referenced files (e.g., PENTEST_VECTORS.md, SEVERITY_GUIDE.md) to reduce the main skill's token footprint while keeping them accessible.

DimensionReasoningScore

Conciseness

The skill is comprehensive and most content earns its place given the security-critical domain, but there's some verbosity — the pentest checklist table, the full severity badge markdown definitions, and the detailed PR submission workflow with emoji reactions add bulk. Some sections (e.g., explaining what each Go test type covers) could be tightened. However, the domain complexity justifies much of the length.

2 / 3

Actionability

Highly actionable throughout — concrete bash commands for determining scope (gh pr diff, git diff), specific code patterns to look for (os.Open, os.Stat), exact API calls for PR submission with full JSON payloads, specific test vector tables, and a clear coverage table template. The review output format is copy-paste ready with badge markdown.

3 / 3

Workflow Clarity

The workflow is clearly sequenced: determine scope → read code → review across 6 dimensions → produce findings with severity → submit review. Each dimension has explicit checklists. The PR submission section includes validation logic (self-review check, finding-based event selection) and error recovery (retry on invalid line position). The test coverage section has a 4-step sub-workflow with explicit inventory → check → check → summarize structure.

3 / 3

Progressive Disclosure

The content is well-organized with clear headers and logical sections, but it's a monolithic ~300-line document with no references to external files. The pentest checklist, PR submission workflow, and detailed review dimensions could be split into separate referenced files. For a skill this complex, the single-file approach creates a large context load. However, no bundle files exist, so there's nothing to split into — but the content would benefit from it.

2 / 3

Total

10

/

12

Passed

Validation

90%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation10 / 11 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

10

/

11

Passed

Repository
DataDog/rshell
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.