CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

openshell-policy-advisor

Use when an OpenShell sandbox returns policy_denied, mentions policy.local, or needs a narrow network policy proposal.

Quality

80%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./crates/openshell-supervisor-process/src/skills/policy-advisor/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

86%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

An exemplarily lean, dense body that turns a denial into a precise five-step recovery procedure with exact paths, endpoints, parameters, and an explicit approval gate before retry. The only real gaps are the unexplained request mechanics (HTTP method, proposal payload shape, origin of chunk_id) and the absence of a rejected/timeout fallback path.

DimensionReasoningScore

Conciseness

Three sentences, zero padding, no explanation of concepts Claude already knows — every phrase ('do not treat the denial as final', the exact paths, endpoints, timeout, and the `policy_reloaded: true` flag) carries operational information. This matches anchor 5: lean, assumes competence, every token earns its place.

5 / 5

Actionability

Concrete, specific guidance: exact file path ('/etc/openshell/skills/policy_advisor.md'), exact endpoints ('http://policy.local/v1/policy/current', 'http://policy.local/v1/proposals', '/v1/proposals/{chunk_id}/wait?timeout=300'), and an exact retry flag ('policy_reloaded: true'). Not a 5 because the request mechanics are unspecified — no HTTP method, no proposal body format, and no statement of where `chunk_id` comes from (presumably the submit response or the referenced advisor doc).

4 / 5

Workflow Clarity

The sequence is unambiguous and correctly ordered: read the advisor doc → inspect current policy → submit narrowest proposal → wait on the proposal → 'retry only after approval'. The approval gate is an explicit checkpoint, but it's a single happy path with no feedback loop for rejection, timeout expiry, or re-denial after retry, so anchor 4 ('clear sequence with most checkpoints present; minor validation gaps') fits better than anchor 5.

4 / 5

Progressive Disclosure

The skill is under 50 lines, single-purpose, has no bundle directories to organize, and its one reference ('/etc/openshell/skills/policy_advisor.md') is clearly signaled and exactly one level deep. Per the simple-skill scoring note, a short, well-organized body with no external-reference needs earns a 5.

5 / 5

Total

18

/

20

Passed

Description

65%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A highly distinctive, trigger-focused description with excellent 'when' phrasing, but it reads almost entirely as a trigger list: the skill's actual capabilities are left implicit. Adding one clause stating what the skill does would lift both specificity and completeness.

Suggestions

Add an explicit capability clause, e.g. 'Reads the current OpenShell network policy, drafts and submits narrow policy proposals, and retries denied requests after approval' before the 'Use when' triggers.

Include a couple of natural user-side synonyms in the triggers, such as 'request blocked/allowed' or 'network allowlist', alongside 'policy_denied'.

State the outcome the skill produces (an approved narrow policy and a successful retry) so the 'what' is not inferred solely from 'needs a narrow network policy proposal'.

DimensionReasoningScore

Specificity

The description names the domain ('OpenShell sandbox') and trigger conditions ('returns policy_denied', 'mentions policy.local', 'needs a narrow network policy proposal') but states no concrete capability actions — what the skill actually does is only implied by the word 'proposal'. It sits between anchor 2 (domain named, actions minimal) and anchor 4 (several specific actions listed), but closer to 3: domain plus an implied single action, not a list of concrete actions.

3 / 5

Completeness

The 'when' is explicit and concrete ('Use when an OpenShell sandbox returns policy_denied...'), but the 'what' is only weakly implied — the skill's actual capabilities (reading the policy, drafting and submitting a proposal, waiting for approval, retrying) never appear. This mirrors anchor 3's shape (one half clear, the other missing/weak) rather than anchor 4, which requires both present.

3 / 5

Trigger Term Quality

Natural trigger terms are well covered: the exact error string 'policy_denied', the hostname 'policy.local', and 'network policy proposal' are the phrases a user or transcript would actually contain in this niche. Not a 5 because common user-side variations like 'request blocked', 'network denied', or 'allowlist/whitelist' are absent.

4 / 5

Distinctiveness Conflict Risk

The OpenShell/policy_denied/policy.local niche is highly distinct with trigger phrases that would not plausibly fire any other skill, matching anchor 5's 'clear niche with distinct triggers; minimal conflict risk'.

5 / 5

Total

15

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

NVIDIA/OpenShell

Path

crates/openshell-supervisor-process/src/skills/policy-advisor/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.