CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

codebase-cleanup-deps-audit

You are a dependency security expert specializing in vulnerability scanning, license compliance, and supply chain security. Analyze project dependencies for known vulnerabilities, licensing issues, outdated packages, and provide actionable remediation strategies.

Quality

57%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./.agent/skills/codebase-cleanup-deps-audit/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

38%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is well-structured into standard sections but is largely abstract: it lists what to do without naming tools or providing executable commands, and its external references are inconsistent and point to non-existent files. The destructive nature of dependency upgrades warrants validation steps that are only weakly present.

Suggestions

Add concrete, executable tooling such as `npm audit --json`, `pip-audit`, `osv-scanner`, or `syft`/`grype` commands so the guidance is copy-paste ready.

Sequence the instructions as a numbered workflow with explicit validation checkpoints (scan -> triage by severity -> verify upgrade in staging -> roll out), rather than a flat bullet list.

Fix the broken, inconsistent references: pick one path for the playbook, ensure the file actually exists in the bundle, and remove the duplicate Knowledge Modules entry.

DimensionReasoningScore

Conciseness

The body is mostly terse and sectioned, but it duplicates the frontmatter description verbatim and references the same playbook file three times (Instructions, Resources, and Knowledge Modules), which is redundant.

3 / 5

Actionability

Instructions are high-level directives ('Inventory direct and transitive dependencies', 'Run vulnerability and license scans') with no named tools, commands, or executable code, so the guidance describes rather than instructs.

2 / 5

Workflow Clarity

Steps are listed but as a flat bullet list rather than a sequenced workflow; the destructive/batch nature of dependency upgrades caps workflow clarity at 3 even though the Safety section mentions staging verification.

3 / 5

Progressive Disclosure

The same playbook is referenced via three inconsistent paths (resources/implementation-playbook.md, ./sub-skills/implementation-playbook.md) and no bundle files actually exist, so navigation is broken and references are not clearly signaled.

2 / 5

Total

10

/

20

Passed

Description

61%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description clearly communicates the skill's domain and concrete actions, but it lacks an explicit trigger ('Use when') clause and uses second-person voice, which caps completeness and reduces specificity. Distinctiveness and trigger-term coverage are reasonably strong.

Suggestions

Add an explicit 'Use when...' clause naming concrete triggers (e.g., 'Use when auditing dependency manifests, checking for vulnerable packages, or preparing a remediation plan').

Rewrite in third person to avoid the specificity penalty (e.g., 'Analyzes project dependencies for known vulnerabilities...').

Include natural synonyms and artifact names users say, such as CVE, lockfile, npm audit, pip-audit, or SBOM.

DimensionReasoningScore

Specificity

Lists several concrete actions ('vulnerability scanning, license compliance, and supply chain security', 'Analyze project dependencies for known vulnerabilities, licensing issues, outdated packages') but is penalized one point for second-person voice ('You are a dependency security expert', 'Analyze...').

3 / 5

Completeness

The 'what' is clearly stated, but there is no explicit 'Use when...' trigger clause, which per the rubric caps completeness at 3.

3 / 5

Trigger Term Quality

Natural terms like 'vulnerability scanning', 'license compliance', 'supply chain security', and 'outdated packages' are present, but common synonyms and concrete artifact names a user would say (CVE, npm audit, lockfile) are missing.

4 / 5

Distinctiveness Conflict Risk

The dependency-security/supply-chain niche is clear and distinguishable from general code-review skills, with only minor overlap risk against broader security skills.

4 / 5

Total

14

/

20

Passed

Validation

87%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

relative_links

Relative link issues: 1 missing

Warning

Total

14

/

16

Passed

Repository

Dokhacgiakhoa/Agent-Skills-4-Vibe-Coding-CLI

Path

.agent/skills/codebase-cleanup-deps-audit/SKILL.md

Revision

c4a059b

Reviewed

Table of Contents

DiscoveryImplementationValidation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.

Claim skill