update-threat-db

Update the guide's threat intelligence through AgentSec Triage, research new coding-agent and MCP security advisories, and synchronize the security feed. Use for threat database refreshes or mise a jour de la base de menaces, not repository security scans or Claude Code release tracking.

Quality

77%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./.agents/skills/update-threat-db/SKILL.md

Quality

Content

75%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is a tight, well-structured procedural skill with concrete commands, a clear sequenced workflow, and explicit validation gates. It leans on external files for the detailed workflow, which keeps it concise but slightly limits self-contained actionability and feedback-loop clarity.

Suggestions

Make the error-recovery feedback loop explicit: state what to do when validation gates fail or artifacts drift (e.g. 're-run --write and re-validate until --check passes').

Inline a one-line summary of the delegated AgentSec workflow steps so the skill remains actionable even if the external command file is unavailable.

Tighten the opening scope paragraph into a single short sentence to lift conciseness toward a 5.

Dimension	Reasoning	Score
Conciseness	The body is lean and procedural with no padding about concepts Claude already knows; a few compound sentences (e.g. the opening scope paragraph) could be tightened, keeping it just below a 5.	4 / 5
Actionability	Concrete commands ('python3 scripts/sync-threat-skill.py --write/--check'), exact file paths, and a precise detected/partial/not_detected/not_applicable taxonomy give mostly executable guidance; it falls short of 5 because the core execution is delegated to an external file rather than self-contained.	4 / 5
Workflow Clarity	A clear three-phase sequence (Resolve → Evidence → Completion checks) with explicit validation gates ('regenerate artifacts twice without drift', 'verify byte equality', run --check) and a numbered checklist; not a 5 because error-recovery feedback loops are implied rather than spelled out.	4 / 5
Progressive Disclosure	Well-organized into clearly labeled sections with one-level-deep, clearly signaled references ('Read ... in full'); at ~45 lines with no bundle files it is well-structured, but the referenced command/script files live outside the skill bundle so navigation is good rather than exemplary.	4 / 5
	Total	16 / 20 Passed

Description

80%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is strong: it answers what and when explicitly, carves out a distinct niche, and includes anti-triggers. Its main weakness is trigger-term quality, where an odd French phrase and missing common synonyms reduce natural keyword coverage.

Suggestions

Replace the French phrase 'mise a jour de la base de menaces' with a natural English synonym like 'update the threat database' so the trigger reads as something a user would actually say.

Add common trigger synonyms such as 'refresh threat intel' or 'security feed sync' to broaden natural keyword coverage.

Consider naming one more concrete sub-action (e.g. deduplication or regression-test generation) to push specificity toward comprehensive coverage.

Dimension	Reasoning	Score
Specificity	Lists three concrete actions ('Update the guide's threat intelligence', 'research new coding-agent and MCP security advisories', 'synchronize the security feed') with minor coverage gaps; not a 5 because it stops at three rather than comprehensively enumerating the workflow's sub-actions.	4 / 5
Completeness	Explicitly states both what it does (update/research/synchronize threat intel) and when to use it ('Use for threat database refreshes... not repository security scans or Claude Code release tracking'), with concrete trigger phrases and an explicit negative boundary.	5 / 5
Trigger Term Quality	Relevant keywords ('threat database refreshes', 'threat intelligence', 'security advisories') are present, but the unnatural French phrase 'mise a jour de la base de menaces' and missing common English synonyms (e.g. 'update threat intel') keep it from full coverage.	3 / 5
Distinctiveness Conflict Risk	A clear niche (coding-agent/MCP threat intelligence via AgentSec) with distinct triggers plus explicit exclusions ('not repository security scans or Claude Code release tracking') minimizes conflict with other skills.	5 / 5
	Total	17 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
referenced_paths_exist	Referenced path issues: 2 missing	Warning

	Total	15 / 16 Passed

Repository: FlorianBruniaux/claude-code-ultimate-guide
Path: .agents/skills/update-threat-db/SKILL.md
Commit: e828d7f

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.