Tessl • The management layer for AI agent skills

Blog Docs Log inGet started

SkillPublic

varlock

Secure-by-default environment variable management for Claude Code sessions.

Quality

67%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/varlock/SKILL.md

Quality

Content

71%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with concrete, executable varlock commands and well-built reference tables, and its core workflows include validation checkpoints. Its weaknesses are redundancy (the never-do rules repeated in four places), a dangling reference to a nonexistent script, and no use of bundle files to split the 425-line monolith.

Suggestions

Consolidate the repeated 'never do' guidance (Rules, Handling, Quick Reference card, and Checklist all restate cat .env / echo $SECRET) into a single canonical section plus one compact table.

Split the schema annotation reference, external secret-source integrations, and troubleshooting into one-level-deep reference files (e.g. references/schema.md, references/integrations.md) and link them from SKILL.md.

Remove or fix the dangling ./scripts/update-github-secrets.sh reference (no scripts/ bundle exists) and drop or relocate the 'Last updated' date stamp, which adds time-sensitive noise.

Dimension	Reasoning	Score
Conciseness	The body is mostly dense, actionable tables and code, but the 'never do' rules (cat .env, echo $SECRET) are repeated across four sections, the curl-pipe install command appears twice, and a bare date stamp ('Last updated: December 22, 2025') adds time-sensitive content — matching 'Mostly efficient but includes some unnecessary explanation or could be tightened'.	3 / 5
Actionability	Fully executable, copy-paste-ready commands throughout: varlock load/run invocations, a concrete .env.schema example with annotation syntax, complete type/sensitivity reference tables, npm scripts JSON, and per-error troubleshooting commands cover the common cases — matching the top anchor.	5 / 5
Workflow Clarity	Key workflows carry explicit validation checkpoints (Pattern 1's 'varlock load --quiet \|\| exit 1', rotation's validate-after-update step, install-then-verify), and a security checklist exists, but there is no single end-to-end validate → fix → retry feedback loop tying the sequences together — 'Clear sequence with most checkpoints present; minor validation gaps'.	4 / 5
Progressive Disclosure	Section headers are well-organized, but the entire skill is a ~425-line monolithic file — schema reference, integrations, and troubleshooting are inlined rather than split into one-level-deep reference files — and the cited ./scripts/update-github-secrets.sh does not exist in the bundle, matching 'Some structure but could be better organized' rather than level 4.	3 / 5
	Total	15 / 20 Passed

Description

48%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description identifies a clear niche and stays concise in third person, but it functions more as a category label than a capability description: no concrete actions are listed and there is no trigger guidance telling Claude when to reach for the skill. Adding natural keywords like 'secrets', '.env', and 'API keys' plus a 'Use when...' clause would lift it substantially.

Suggestions

List 2-3 concrete capabilities in the description, e.g. 'Validates and masks environment variables and secrets, and runs commands with injected env — never exposing values to the session context.'

Add an explicit trigger clause: 'Use when handling .env files, API keys, secrets, or environment variable validation in Claude Code sessions.'

Include natural synonyms users would actually say — secrets, .env, API keys, tokens — to improve trigger-term coverage.

Dimension	Reasoning	Score
Specificity	The description names the domain ("environment variable management") and adds a qualifier ("Secure-by-default"), but enumerates no concrete actions such as validate, mask, or inject — matching the anchor 'Names the domain but actions are minimal or generic' rather than the level-3 anchor which requires 1-2 concrete listed actions.	2 / 5
Completeness	The 'what' is reasonably clear (secure-by-default env var management), but there is no 'Use when...' clause or equivalent explicit trigger guidance; 'for Claude Code sessions' only weakly implies when, which caps completeness at 3 per the judging guidelines.	3 / 5
Trigger Term Quality	"environment variable" is a relevant domain keyword users might say, but the natural phrases for this skill's actual use cases — secrets, .env, API keys, tokens — are missing, matching 'Some relevant keywords but missing common variations or synonyms'. It scores above 2 only if the keyword were generic like 'Works with files', which it is not.	3 / 5
Distinctiveness Conflict Risk	The scope (secure environment variable handling in Claude Code sessions) is a clear niche with only minor overlap risk against closely related generic dotenv/secrets-management skills — matching 'Mostly distinct; minor overlap risk' rather than level 5, which expects distinct trigger phrases that this description lacks.	4 / 5
	Total	12 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: administrakt0r/AI-Agents-Safe-Coding-Skills
Path: skills/varlock/SKILL.md
Revision: 64adc55

Reviewed: 15 hours ago

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.

varlock

Table of Contents

Is this your skill?