CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

code-review

Automated code review skill focusing on financial security, token leakage detection, concurrency bugs, EF Core performance traps, and architectural compliance.

Quality

72%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./.agents/skills/code-review/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

75%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is an efficient, highly actionable review framework: concrete rules with exact API names, a severity matrix, and a structured finding template. Its main gaps are the absence of an explicit verification/feedback loop in the workflow and no worked example of a real finding, plus minor redundancy in the opening.

Suggestions

Add a validation step to the workflow, e.g. "5. Verify: re-check each CRITICAL/HIGH finding against the relevant checklist layer and confirm line links before reporting", creating a feedback loop for misclassified findings.

Include one short worked example of a completed finding (title, location, category, problem, diff fix) so the template's use is unambiguous.

Trim the duplicated scope statements (the intro paragraph and workflow step 1) to reclaim tokens.

DimensionReasoningScore

Conciseness

The body is a tight, checklist-driven document with concrete specifics ("Math.Round(val, 2, MidpointRounding.ToEven)", "[Timestamp] or uint RowVersion", ".AsNoTracking()", "ExecuteUpdateAsync") and almost no padding or explanation of concepts Claude already knows. It misses a 5 only for minor redundancy — the opening paragraph and workflow step 1 restate the description's scope.

4 / 5

Actionability

Guidance is largely executable and checkable: exact API/pattern names per rule ("catch DbUpdateConcurrencyException", "avoid .Result/.Wait()", "Idempotency-Key or SHA256 HashUnoco"), a concrete severity matrix, and a copy-paste finding template with a diff example. Minor gaps: no worked example of an actual finding at each severity and no concrete command beyond "git diff".

4 / 5

Workflow Clarity

The 4-step workflow (fetch changes → execute checklist → classify by severity → generate report) is clearly sequenced, and the severity classification acts as an implicit checkpoint. It is not a 5 because there is no explicit validation or feedback loop — e.g., re-verifying flagged lines or confirming each CRITICAL finding against the checklist before reporting — leaving minor validation gaps.

4 / 5

Progressive Disclosure

Content is well-organized into clearly signaled sections (five checklist layers, output format, workflow) with no nested references and no bundle files to navigate. It is not a 5 because at ~80 lines the five detailed layer checklists could arguably be split into one-level-deep reference files, and the inlined detail is only borderline appropriate for the main SKILL.md.

4 / 5

Total

16

/

20

Passed

Description

58%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and reasonably distinct, naming five concrete focus areas, but it lacks any 'Use when...' trigger guidance and misses common trigger synonyms (PR, pull request, diff, audit). It reads as a capability summary rather than a trigger-optimized skill description.

Suggestions

Add an explicit trigger clause, e.g. "Use when reviewing C#/.NET code, pull requests, or diffs in the FinanceHub repository, or when the user mentions code review, PR review, or auditing financial services code."

Include natural synonyms and stack qualifiers users would actually say — 'pull request', 'PR', 'diff', 'audit', '.NET', 'C#' — to improve trigger term coverage and distinctiveness.

Lead with concrete action verbs ("Reviews ... for", "Detects") instead of "focusing on" so the what is expressed as actions, not just topics.

DimensionReasoningScore

Specificity

The description lists several specific focus areas — "financial security, token leakage detection, concurrency bugs, EF Core performance traps, and architectural compliance" — giving concrete capability coverage. It stops short of a 5 because these are domains/topics rather than distinct concrete actions ('detects', 'audits', 'reports'), so there are minor gaps in action-level coverage.

4 / 5

Completeness

There is a clear 'what' ("Automated code review skill focusing on ..."), but there is no 'Use when...' clause or equivalent trigger guidance, which caps completeness at 3 per the judging guidelines. The 'when' is entirely absent, not merely weakly implied.

3 / 5

Trigger Term Quality

"code review" and "security", "concurrency", "EF Core" are natural, relevant keywords a user might say. However common variations are missing — 'PR', 'pull request', 'diff', 'audit', '.NET'/'C#' — so keyword coverage is partial rather than good.

3 / 5

Distinctiveness Conflict Risk

"financial security", "token leakage detection", and "EF Core performance traps" carve out a fairly distinct niche with low conflict risk against generic skills. It stays at 4 rather than 5 because the description omits the repo/stack qualifiers (FinanceHub, .NET/C#) found in the body, so it could still overlap with a generic code-review skill.

4 / 5

Total

14

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

relative_links

Relative link issues: 1 suspicious

Warning

Total

15

/

16

Passed

Repository

JoseMD12/finance-hub

Path

.agents/skills/code-review/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.