CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

varlock-claude-skill

Secure environment variable management ensuring secrets are never exposed in Claude sessions, terminals, logs, or git commits

Quality

46%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/varlock-claude-skill/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

18%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is hollow: it repeats the description three times and provides zero actionable instruction — no commands, code, patterns, or workflow. Its only substance is a link to an external repository, making the skill unusable as written despite a clean section structure.

Suggestions

Replace the filler Instructions section with concrete, executable guidance: actual commands or code patterns for storing, injecting, and checking secrets (e.g. specific CLI invocations and examples).

Delete the verbatim restatements of the description in Overview and When to Use, or make When to Use list concrete trigger conditions instead of repeating the description.

Bundle the detailed guidance from the source repository into local reference files (e.g. references/usage.md) and link to them one level deep instead of punting to an external GitHub URL.

DimensionReasoningScore

Conciseness

The body restates the frontmatter description nearly verbatim three times across Overview, When to Use, and Instructions ('secure environment variable management ensuring secrets are never exposed in claude sessions, terminals, logs, or git commits') — several padded sections with no added value; not anchor 1 since it is not severely verbose in absolute length.

2 / 5

Actionability

No code, commands, steps, or patterns anywhere in the body; the Instructions section only says 'This skill provides guidance and patterns for...' and links to an external repository — entirely vague, describing rather than instructing, an exact match for anchor 1.

1 / 5

Workflow Clarity

No sequence of steps exists at all; there is no workflow to evaluate and no validation checkpoints, matching anchor 1 ('Steps missing or incoherent; no sequence').

1 / 5

Progressive Disclosure

The body is short with conventionally organized sections (Overview, When to Use, Instructions) and no bundle files to reference, but the only substantive pointer is an external GitHub URL standing in for missing internal content — good structure with a minor organization gap rather than the clear one-level-deep references of anchor 5.

4 / 5

Total

8

/

20

Passed

Description

48%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description identifies a distinct and meaningful niche (preventing secret exposure across sessions, terminals, logs, and commits) but reads as a domain statement rather than a capability description. It lists no concrete actions and completely lacks a 'Use when...' trigger clause, weakening discoverability and completeness.

Suggestions

Enumerate concrete actions, e.g. 'Store secrets encrypted, inject them into commands without echoing, and scan commits and logs for leaked credentials'.

Add an explicit trigger clause, e.g. 'Use when handling API keys, tokens, .env files, or credentials, or when the user mentions secrets, dotenv, or leaking secrets in logs or commits'.

Include common user-side synonyms such as 'API keys', 'credentials', '.env files', and 'dotenv' to improve natural trigger matching.

DimensionReasoningScore

Specificity

Names the domain ('Secure environment variable management', 'secrets are never exposed') but lists no concrete actions such as storing, injecting, rotating, or scanning — actions are minimal or generic, matching anchor 2 rather than anchor 3 which requires 1-2 concrete actions.

2 / 5

Completeness

Has a clear 'what' ('secure environment variable management ensuring secrets are never exposed') but no 'Use when...' clause or equivalent explicit trigger guidance, which caps completeness at 3 per the judging guidelines.

3 / 5

Trigger Term Quality

Includes some natural keywords ('environment variable', 'secrets', 'logs', 'git commits') but misses common variations and synonyms users would actually say such as 'API keys', 'credentials', '.env files', 'dotenv', or 'tokens'.

3 / 5

Distinctiveness Conflict Risk

The phrase 'Claude sessions, terminals, logs, or git commits' carves a mostly distinct niche with minor overlap risk against generic secrets-management or dotenv skills; not anchor 5, which requires explicit distinct trigger phrases.

4 / 5

Total

12

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository

administrakt0r/AI-Agents-Safe-Coding-Skills

Path

skills/varlock-claude-skill/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.