CtrlK
BlogDocsLog inGet started
Tessl Logo

remediation

Helps fix security vulnerabilities identified by DryRunSecurity. Activates when the user shares a DryRunSecurity comment (from a GitHub PR or GitLab MR) or asks for help fixing any security finding including SQL injection, XSS, CSRF, SSRF, path traversal, command injection, authentication bypass, authorization flaws, and prompt injection. Researches authoritative sources and applies fixes grounded in the user's specific codebase context.

96

1.16x
Quality

96%

Does it follow best practices?

Impact

100%

1.16x

Average score across 3 eval scenarios

SecuritybySnyk

Low

Low-risk findings worth noting

The canonical home for this skill is dryrunsecurity/remediation

SKILL.md
Quality
Evals
Security

Quality

Content

92%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is a tight, well-sequenced remediation workflow with concrete examples and minimal filler. Its main weakness is progressive disclosure: the body links to three reference files that are not present in the skill bundle, leaving the promised navigation broken.

Suggestions

Create the three referenced bundle files (DRYRUN_FILTERING.md, FINDING_FORMAT.md, VULNERABILITY_TYPES.md) referenced from the body, or remove the links and inline the essential content into SKILL.md.

Add an explicit validate-and-retry checkpoint to Step 4/Step 5 (e.g., 're-run the project's security check and only finalize when the finding is cleared') to strengthen the feedback loop for the fix.

For the Example section, note how to locate the vulnerable line's surrounding context before editing, so the minimal fix is reproducible across different repos.

DimensionReasoningScore

Conciseness

The body is lean and action-oriented ('Action: Use Glob and Grep to search, Read to examine'), assumes Claude's competence, and avoids padding with background concepts Claude already knows.

3 / 3

Actionability

Provides concrete, executable guidance including a complete before/after Go code example, specific search targets in a table, named research sources, and a copy-paste-ready commit format.

3 / 3

Workflow Clarity

A clearly sequenced five-step process with an explicit gate ('Do NOT propose a fix until complete') and verification steps in Step 5; the single-fix operation is not a batch/destructive task that would require a stricter validate-retry loop.

3 / 3

Progressive Disclosure

References are clearly signaled and one level deep (DRYRUN_FILTERING.md, FINDING_FORMAT.md, VULNERABILITY_TYPES.md), but none of these files actually exist in the bundle, so the navigation they promise is broken.

2 / 3

Total

11

/

12

Passed

Description

100%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is concise yet complete: it states the skill's purpose, gives an explicit activation clause, and lists a broad set of natural trigger terms. It is distinctive to the DryRunSecurity context and unlikely to conflict with other skills.

DimensionReasoningScore

Specificity

Names multiple concrete actions ('Researches authoritative sources and applies fixes grounded in the user's specific codebase context') in a specific security-remediation domain, matching the top anchor; third-person voice is used throughout.

3 / 3

Completeness

Explicitly answers both what ('fix security vulnerabilities identified by DryRunSecurity') and when ('Activates when the user shares a DryRunSecurity comment ... or asks for help fixing any security finding'), matching the top anchor.

3 / 3

Trigger Term Quality

Strong coverage of natural terms a user would say ('SQL injection, XSS, CSRF, SSRF, path traversal, command injection, authentication bypass, authorization flaws, and prompt injection') plus the DryRunSecurity comment trigger.

3 / 3

Distinctiveness Conflict Risk

Has a clear, narrow niche (DryRunSecurity-specific remediation) with distinct triggers unlikely to fire for unrelated skills.

3 / 3

Total

12

/

12

Passed

Validation

87%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation14 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

relative_links

Relative link issues: 3 missing

Warning

Total

14

/

16

Passed

Repository
DryRunSecurity/external-plugin-marketplace
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.