CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

fix-security-issue

Implement an authorized fix for a reviewed security issue and open a PR that closes its issue.

Quality

77%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./.agents/skills/fix-security-issue/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

93%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A tightly written, highly operational instruction-only skill: it provides exact commands, markers, and PR syntax while cleanly delegating repo-specific conventions to named documents one level deep. The only notable gap is the absence of an explicit failure-recovery loop around the step-4 verification checks.

DimensionReasoningScore

Conciseness

The body is lean and dense with every clause carrying operational rules (e.g., "Do not infer approval from a state that only records technical validation", "do not require unaffected Rust or SDK suites solely to create a signed-off commit or PR") and no explanations of concepts Claude already knows. It fits the anchor 'every token earns its place' rather than 4, since there is no over-explanation to trim.

5 / 5

Actionability

Fully concrete guidance throughout: the copy-paste-ready command "gh issue view <id> --json number,title,body,state,labels,comments", exact markers "> **🔒 security-review-agent**" and "> **🔧 security-fix-agent**", the exact "Closes #<id>" PR syntax, and a specific verification list (format, lint, compile/type checks, regression tests, E2E lane). It is not 4 because nothing is left vague — delegation to named files (CONTRIBUTING.md sections, create-github-pr) is explicit signaling, not a gap.

5 / 5

Workflow Clarity

A clear five-step sequence with explicit checkpoints: stop conditions ("If the review is missing or found the issue not actionable, stop and report"), review verification ("Verify the review against current code"), and pre-PR verification in step 4. It falls short of the 5 anchor because there is no explicit feedback loop for verification failures (no 'if checks fail, fix and re-run' instruction), and full error recovery is only spelled out for the review-missing case.

4 / 5

Progressive Disclosure

The skill is under 50 lines with no bundle files and a well-organized numbered structure; all references ("Label Discovery in CONTRIBUTING.md", "Branch Names in CONTRIBUTING.md", "create-github-pr", "openshell-crypto", the crypto architecture link) are clearly signaled and exactly one level deep. Per the rubric's under-50-lines exception, this earns the top score.

5 / 5

Total

19

/

20

Passed

Description

53%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is concise, concrete, and appropriately scoped to a distinct remediation niche, but it omits any explicit 'when to use' trigger guidance and lacks natural synonyms like 'vulnerability' or 'CVE'. Adding a Use-when clause with trigger phrases would lift both completeness and trigger-term quality.

Suggestions

Add an explicit trigger clause, e.g., "Use when the user asks to fix, remediate, or resolve a reviewed or triaged security issue, or after a security review has flagged an actionable concern."

Include natural synonyms users would actually say — "vulnerability", "CVE", "security finding", "remediate" — alongside "security issue" to broaden trigger-term coverage.

Mention one or two more concrete actions (e.g., verify the review against current code, run verification and regression tests) to strengthen specificity beyond the two currently listed.

DimensionReasoningScore

Specificity

It names the domain and two concrete, well-qualified actions — "Implement an authorized fix for a reviewed security issue" and "open a PR that closes its issue" — which matches the anchor 'names domain and 1-2 concrete actions, but not comprehensive'. It is not 4 because coverage stops at two actions (no mention of verifying the review, running verification, or regression tests), and not 2 because the actions are specific rather than generic.

3 / 5

Completeness

The 'what' is clear (implement an authorized fix, open a closing PR), but there is no 'Use when...' clause or equivalent explicit trigger guidance; 'when' is only weakly implied by "for a reviewed security issue". Per the rubric guideline, a missing 'Use when' clause caps completeness at 3.

3 / 5

Trigger Term Quality

"security issue", "fix", and "PR" are natural terms a user might say, but common variations and synonyms are missing — notably "vulnerability", "CVE", "security finding", and "remediation". This fits 'some relevant keywords but missing common variations or synonyms' rather than the 4 anchor's good coverage.

3 / 5

Distinctiveness Conflict Risk

The qualifiers "authorized fix", "reviewed security issue", and "PR that closes its issue" carve a distinct niche with minor overlap risk against generic fix-issue or create-PR skills. It is not 5 because without trigger phrases it could still be selected for ordinary bug-fix or PR-creation requests mentioning security.

4 / 5

Total

13

/

20

Passed

Validation

81%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 13 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

metadata_field

'metadata' should map string keys to string values

Warning

relative_links

Relative link issues: 1 suspicious

Warning

Total

13

/

16

Passed

Repository

NVIDIA/OpenShell

Path

.agents/skills/fix-security-issue/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.