common-dast-tooling
Standardize dynamic application security testing for backend APIs, frontend web apps, and mobile clients. Covers ZAP, Nuclei, Nikto, sqlmap, ffuf, browser automation, mobile proxy interception, and AI-driven curl probes. Use when advising on or running dynamic security scans on local/staging environments.
53
61%
Does it follow best practices?
Impact
—
No eval scenarios have been run
Passed
No known issues
Optimize this skill with Tessl
npx tessl skill review --optimize ./.github/skills/common/common-dast-tooling/SKILL.mdQuality
Discovery
100%Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.
This is a strong skill description that clearly defines its scope (DAST across multiple target types), lists specific tools and techniques, and includes an explicit 'Use when' clause with appropriate trigger conditions. The description is concise yet comprehensive, covering both the what and when effectively while maintaining clear distinctiveness from other security-related skills.
| Dimension | Reasoning | Score |
|---|---|---|
Specificity | Lists multiple specific concrete actions and tools: ZAP, Nuclei, Nikto, sqlmap, ffuf, browser automation, mobile proxy interception, and AI-driven curl probes. Also specifies target types: backend APIs, frontend web apps, and mobile clients. | 3 / 3 |
Completeness | Clearly answers both 'what' (standardize DAST for backend APIs, frontend web apps, mobile clients using specific tools) and 'when' (explicit 'Use when advising on or running dynamic security scans on local/staging environments'). | 3 / 3 |
Trigger Term Quality | Includes strong natural keywords users would say: 'dynamic application security testing', 'security scans', 'ZAP', 'Nuclei', 'sqlmap', 'ffuf', 'Nikto', 'mobile proxy', 'DAST' (implied by the full phrase), 'staging environments'. These cover both tool-specific and concept-level terms users would naturally use. | 3 / 3 |
Distinctiveness Conflict Risk | Highly distinctive niche: dynamic application security testing with specific tool names and target types. Unlikely to conflict with static analysis, dependency scanning, or other security skills due to the explicit 'dynamic' qualifier and named tools. | 3 / 3 |
Total | 12 / 12 Passed |
Implementation
22%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
This skill reads more like a reference catalog of DAST tools than an actionable guide Claude can follow. It lists many tools with brief descriptions but provides zero executable commands, no workflow sequence, and no concrete examples. The critical implementation details are deferred to a referenced file that doesn't exist in the bundle, leaving the skill effectively non-functional.
Suggestions
Add concrete, executable command examples for at least the primary tools (e.g., actual Nuclei, ZAP-CLI, sqlmap commands with flags and placeholder targets) directly in the SKILL.md body.
Define a clear step-by-step workflow for conducting a DAST scan: e.g., 1) enumerate endpoints, 2) run passive scan, 3) run active scan, 4) validate findings, 5) report — with explicit validation checkpoints between steps.
Either include the referenced 'references/implementation.md' file in the bundle or inline the essential setup commands so the skill is self-contained and actionable.
Remove descriptive text about what tools are (Claude knows) and replace with specific invocation patterns showing flags, authentication headers, and expected output formats.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | Generally efficient with bullet-point format and tables, but includes some unnecessary categorization and description that Claude already knows (e.g., explaining what Nikto or Lighthouse does). The scoring impact table adds bulk that may not be actionable for Claude. | 2 / 3 |
Actionability | Almost entirely descriptive rather than instructive — lists tools and what they do but provides no executable commands, code snippets, or concrete examples. The 'See implementation guide' references defer all actionable content to a file that doesn't exist in the bundle, leaving the skill body with no copy-paste-ready guidance. | 1 / 3 |
Workflow Clarity | No sequenced workflow is provided for running a DAST scan. There are no steps, no validation checkpoints, and no feedback loops for what to do when findings are discovered. For a multi-tool, multi-step security testing process, this is a significant gap. | 1 / 3 |
Progressive Disclosure | References to 'references/implementation.md' are well-signaled and one level deep, which is good structure. However, the bundle has no files, meaning the referenced implementation guide doesn't exist, undermining the progressive disclosure. The main file also inlines content (scoring table, anti-patterns) that could be separated while lacking the core actionable content that should be present. | 2 / 3 |
Total | 6 / 12 Passed |
Validation
81%Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.
Validation — 9 / 11 Passed
Validation for skill structure
| Criteria | Description | Result |
|---|---|---|
metadata_version | 'metadata.version' is missing | Warning |
metadata_field | 'metadata' should map string keys to string values | Warning |
Total | 9 / 11 Passed | |
- Repository
- HoangNguyen0403/agent-skills-standard
- Commit
3df717f
- Reviewed
Table of Contents
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.