varlock

Secure-by-default environment variable management for Claude Code sessions.

Quality

41%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/varlock/SKILL.md

Quality

Content

46%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The skill provides genuinely useful security guidance for environment variable management with Varlock, featuring concrete commands and good anti-patterns. However, it is significantly over-long due to repetitive security warnings across multiple sections and content that should be split into separate reference files. The workflow sequences lack explicit validation checkpoints and error recovery loops that would be expected for security-critical operations.

Suggestions

Consolidate the security rules into a single authoritative section and remove repetition from the quick reference card, handling tasks section, and checklist — the same 'never echo/cat secrets' message appears in at least 5 places.

Split type annotations, external secret source integrations, Docker/CI patterns, and troubleshooting into separate reference files (e.g., TYPES.md, INTEGRATIONS.md, TROUBLESHOOTING.md) and link from the main skill.

Add explicit validation checkpoints to the installation and initialization workflows (e.g., after `varlock init`, verify the schema was created correctly with a specific check command).

Remove the 'When User Asks' scripted response sections — Claude can infer appropriate responses from the security rules without being given verbatim scripts.

Dimension	Reasoning	Score
Conciseness	The skill is significantly verbose at ~300+ lines. It repeats the same security rules multiple times (e.g., 'never echo secrets' appears in the rules section, safe commands section, handling tasks section, quick reference card, and security checklist). The 'When User Asks' sections script Claude's responses, which is somewhat useful but padded. Tables for type annotations and security annotations explain concepts Claude could infer from examples. The integration section at the end references skills that may not exist.	2 / 5
Actionability	The skill provides concrete, executable bash commands and code examples throughout — installation commands, varlock CLI usage, schema file syntax, npm scripts, Docker/CI integration. Minor gaps include the external secret sources section which shows syntax without full context of whether these are real varlock features, and some examples are illustrative rather than copy-paste ready (e.g., the GitHub Actions snippet assumes specific secret names).	4 / 5
Workflow Clarity	Several workflows are present (installation, initialization, validation-before-operations, secret rotation) but they lack explicit validation checkpoints and error recovery loops. Pattern 1 shows a validate-then-proceed pattern, but the installation workflow has no verification step beyond `varlock --version`. The secret rotation workflow is vague ('Update secret in external source'). The troubleshooting section helps but isn't integrated into the workflows as feedback loops.	3 / 5
Progressive Disclosure	All content is inlined in a single monolithic file with no bundle files or references to separate documentation files. At 300+ lines, the type annotations table, external secret sources, Docker/CI integration patterns, and troubleshooting sections would benefit from being split into separate reference files. The skill references external URLs (varlock.dev, GitHub repo) and other skills but doesn't organize its own content across files.	2 / 5
	Total	11 / 20 Passed

Description

36%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description identifies a clear domain (environment variable management) but lacks concrete actions, trigger terms, and a 'when to use' clause. It reads more like a tagline than a functional description that would help Claude select this skill from a large pool. The 'secure-by-default' qualifier adds some distinctiveness but doesn't compensate for the missing operational details.

Suggestions

Add concrete actions describing what the skill does, e.g., 'Sets, reads, masks, and validates environment variables for Claude Code sessions.'

Add a 'Use when...' clause with trigger terms like 'Use when the user needs to manage env vars, secrets, API keys, .env files, or session configuration in Claude Code.'

Include natural synonyms and variations such as 'env vars', '.env', 'secrets', 'API keys', 'configuration variables' to improve trigger term coverage.

Dimension	Reasoning	Score
Specificity	Names the domain ('environment variable management') but provides no concrete actions. 'Secure-by-default' is a modifier, not an action. No verbs describing what the skill actually does (e.g., set, read, mask, inject, validate).	2 / 5
Completeness	The 'what' is vague ('management' without specifying concrete operations), and there is no 'when' clause at all. The absence of a 'Use when...' clause caps this at 3, and the weak 'what' brings it down further.	2 / 5
Trigger Term Quality	'Environment variable' is a relevant keyword users might use, and 'Claude Code sessions' provides context. However, it misses natural synonyms and variations like 'env vars', '.env files', 'secrets', 'configuration', 'API keys'.	3 / 5
Distinctiveness Conflict Risk	'Environment variable management' is somewhat specific, and 'Claude Code sessions' narrows the scope. However, it could overlap with general configuration management, secrets management, or session setup skills.	3 / 5
	Total	10 / 20 Passed

Validation

90%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 10 / 11 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	10 / 11 Passed

Repository: administrakt0r/AI-Agents-Safe-Coding-Skills
Path: skills/varlock/SKILL.md
Commit: 900c504

Reviewed: 6 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.