CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

audit-context-building

Enables ultra-granular, line-by-line code analysis to build deep architectural context before vulnerability or bug finding.

Quality

60%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./plugins/AI-Agents-Safe-Coding-Skills/skills/audit-context-building/SKILL.md

The canonical home for this skill is audit-context-building in sickn33/agentic-awesome-skills

SKILL.md
Quality
Evals
Security

Quality

Content

52%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The skill's core process is well-designed — a concrete per-function checklist, numeric quality thresholds, clear phase sequencing, and an anti-rationalization table — but the document is padded with threefold-repeated non-goals and restated rules, and its progressive-disclosure design is broken because every referenced satellite file is missing from the bundle. Fixing the missing files and cutting the repetition would lift it substantially.

Suggestions

Ship the referenced files (FUNCTION_MICRO_ANALYSIS_EXAMPLE.md, OUTPUT_REQUIREMENTS.md, COMPLETENESS_CHECKLIST.md) in a references/ directory, or inline their essential content — especially the output format that section 5.4 declares Claude MUST follow, and fix section 1's dangling 'see Example: Function Micro-Analysis below' pointer.

Deduplicate the body: merge section 1 and section 3 (identical bullet lists), and collapse 'Do not use for', section 9, and section 10 into a single non-goals statement — this would cut roughly a third of the document.

Replace the vague Phase 2 to Phase 3 transition ('After sufficient micro-analysis') with a concrete exit criterion, e.g. 'proceed to Phase 3 once every externally-reachable function has completed the 5.5 checklist'.

DimensionReasoningScore

Conciseness

Noticeably verbose through redundancy: section 1 (Purpose) and section 3 (How This Skill Behaves) repeat the same bullets ('Apply First Principles, 5 Whys, and 5 Hows', ultra-granular analysis, mental model); the non-goal list appears three times ('Do not use for', section 9 'Relationship to Other Phases', section 10 'Non-Goals'); and section 5.4's 'Key requirements' restate section 5.1's checklist. Not 3 because several sections add no new information; not 1 because nothing explains concepts Claude already knows.

2 / 5

Actionability

For an instruction-only skill the guidance is concrete and specific: a per-function microstructure checklist (Purpose, Inputs & Assumptions, Outputs & Effects, block-by-block with What/Why/Assumptions/Invariants), numeric quality thresholds ('Minimum 3 invariants per function', 'At least 3 combined 5 Whys/5 Hows applications'), and a rationalization table with concrete required actions. Not 5 because no worked example is shown inline and terms like 'First Principles at micro scale' are never demonstrated.

4 / 5

Workflow Clarity

Phases 1 (Orientation), 2 (Per-Function Analysis), and 3 (Global Understanding) are clearly sequenced, with an explicit completeness checklist (5.5) before concluding a function and a contradiction feedback loop ('Earlier I thought X; now Y'). Not 5 because the Phase 2 to Phase 3 transition is vague ('After sufficient micro-analysis'), the referenced COMPLETENESS_CHECKLIST.md is unavailable, and section 1's 'see Example: Function Micro-Analysis below' points to an example that is not below.

4 / 5

Progressive Disclosure

The body signals three satellite files (FUNCTION_MICRO_ANALYSIS_EXAMPLE.md, OUTPUT_REQUIREMENTS.md, COMPLETENESS_CHECKLIST.md) but the bundle contains no references/, scripts/, or assets/ directories — none of the referenced files exist. Section 5.4 mandates output 'following the format defined in OUTPUT_REQUIREMENTS.md', which is unavailable, and section 1's inline example pointer dangles, so navigation is broken despite good signaling. Not 3 because clearly-signaled references that cannot be opened are worse than weakly-signaled ones that work.

2 / 5

Total

12

/

20

Passed

Description

50%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description communicates a real niche but reads like an intensifier-laden capability statement rather than a trigger-optimized one. It lacks an explicit 'Use when' clause, natural trigger synonyms are absent, and the 'vulnerability or bug finding' phrasing risks firing for requests the skill explicitly refuses to handle.

Suggestions

Add an explicit 'Use when...' clause, e.g. 'Use when preparing for a code audit, security review, or threat model and deep understanding of the codebase is needed before finding bugs.'

Include natural trigger terms and synonyms users would actually say: 'code audit', 'security review', 'understand the codebase', 'build context before bug hunting'.

Clarify the boundary in the description so it does not trigger for direct requests to find vulnerabilities or rate severity, e.g. 'Not for finding or rating vulnerabilities itself — runs before that phase.'

DimensionReasoningScore

Specificity

The description names the domain (code analysis) and 1-2 concrete actions ('line-by-line code analysis', 'build deep architectural context'), but 'ultra-granular' is an intensifier rather than a capability and coverage is not comprehensive. It sits above 2 (more concrete than 'Processes PDF files') but below 4 (does not list several specific actions).

3 / 5

Completeness

The 'what' is clearly stated (line-by-line analysis to build architectural context), but there is no 'Use when...' clause or equivalent explicit trigger guidance; 'before vulnerability or bug finding' describes sequencing, not a user trigger, so completeness is capped at 3 per the judging guideline. Not 2 since the 'what' is concrete and a 'when' is weakly implied.

3 / 5

Trigger Term Quality

Terms like 'code analysis', 'vulnerability', and 'bug finding' are relevant, but common natural variations users would say ('audit', 'security review', 'understand the codebase') are missing, and 'ultra-granular' is jargon users would not naturally say. Matches 'Some relevant keywords but missing common variations or synonyms'.

3 / 5

Distinctiveness Conflict Risk

The niche (context building prior to auditing) is somewhat distinct, but the description contains 'vulnerability or bug finding', which would cause it to trigger when users ask to find bugs — explicitly a non-goal of the skill — creating overlap risk with security-review and code-review skills. Not 4 because this mis-trigger path is plausible; not 2 because the skill is not broadly generic.

3 / 5

Total

12

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository

administrakt0r/AI-Agents-Safe-Coding-Skills

Path

plugins/AI-Agents-Safe-Coding-Skills/skills/audit-context-building/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.