CtrlK
BlogDocsLog inGet started
Tessl Logo

scanner-overview

Stage 1 broad-spectrum scanner playbook. Sharded sweep over very large codebases producing CANDIDATE nodes for the Detector to reason about. Load at scanner-agent startup.

59

Quality

68%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/plugins/scanner/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

87%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a tight, highly actionable playbook with strong conciseness, concrete tooling, and clean sectioning; its main gap is the absence of an explicit validation/verification checkpoint in the batch sweep workflow.

Suggestions

Insert an explicit validation step in the workflow, e.g., "5b. Verify each shard returned and that promoted candidates have path+line+score before kg_add_candidate," to add a feedback loop for the batch operation.

Add a one-line guardrail confirming shard coverage (e.g., "confirm sum of shard file counts matches the wc -l estimate") so a dropped shard is caught before ranking.

DimensionReasoningScore

Conciseness

The body is lean and punchy — short operating principles, a compact decision table, and a terse workflow — and it never explains concepts Claude already knows (e.g., what grep or a sink is), so every token earns its place.

3 / 3

Actionability

It gives fully concrete, executable guidance: named tools ("scan_shard", "rank_candidates", "kg_add_candidate"), specific shard counts (4/8/16), a file-count decision table, and a copy-pasteable numbered command workflow.

3 / 3

Workflow Clarity

The six-step workflow is clearly sequenced and begins with sanity-check/sizing steps, but for a batch operation over 10^4–10^6 files it has no explicit validation checkpoint or feedback loop (e.g., verify shard outputs before ranking), capping it at 2.

2 / 3

Progressive Disclosure

The skill is short and organized into well-labeled sections (Operating principles, Decision, Workflow, Sink kinds, What NOT to do) and defers the bulky regex table to a single one-level-deep reference ("decepticon/research/scanner_tools.py") rather than inlining it.

3 / 3

Total

11

/

12

Passed

Description

50%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is technically precise and conveys a clear pipeline role, but it reads as internal jargon rather than user-facing trigger language and lacks an explicit "Use when..." clause, leaving every dimension at the mid-level anchor.

Suggestions

Add an explicit "Use when..." clause (e.g., "Use when beginning a vulnerability sweep over a large codebase") to lift completeness to 3.

Replace or augment pipeline jargon ("CANDIDATE nodes", "the Detector") with natural trigger terms users would actually say, such as "scan", "sweep", "triage", "find suspicious code".

Add one or two more concrete actions (e.g., "rank and triage") so the capability list reads as multiple specific actions rather than a single described process.

DimensionReasoningScore

Specificity

Names the domain and a couple of concrete actions ("Sharded sweep over very large codebases producing CANDIDATE nodes") but does not list multiple distinct actions like the score-3 anchor, so it sits at "names domain and some actions, not comprehensive."

2 / 3

Completeness

It clearly answers "what" (sharded sweep producing candidates) but the only "when" guidance is "Load at scanner-agent startup," a loading instruction rather than an explicit "Use when..." trigger, so completeness is capped at 2 per the judging guidelines.

2 / 3

Trigger Term Quality

It includes some relevant natural terms ("scanner", "codebases", "sweep") but mixes in pipeline jargon ("CANDIDATE nodes", "the Detector", "sharded") that users would not naturally say, matching the "some relevant keywords but missing common variations" anchor.

2 / 3

Distinctiveness Conflict Risk

It carves a niche (Stage 1 scanner of a vulnresearch pipeline) but its trigger terms ("scanner", "codebase sweep") are generic enough to overlap with other scanning skills, fitting the "somewhat specific but could still overlap" anchor.

2 / 3

Total

8

/

12

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

Total

15

/

16

Passed

Repository
PurpleAILAB/Decepticon
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.