CtrlK
BlogDocsLog inGet started
Tessl Logo

varlock-claude-skill

Secure environment variable management ensuring secrets are never exposed in Claude sessions, terminals, logs, or git commits

36

Quality

34%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./plugins/AI-Agents-Safe-Coding-Skills-claude/skills/varlock-claude-skill/SKILL.md

The canonical home for this skill is varlock-claude-skill in administrakt0r/AI-Agents-Safe-Coding-Skills

SKILL.md
Quality
Evals
Security

Quality

Content

15%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a thin, repetitive stub that restates the description three times and gives no executable guidance, workflow, or validation. It fails to add anything Claude does not already know about the topic.

Suggestions

Replace the repeated description with concrete, executable guidance: specific commands or code for loading/masking secrets and preventing them from reaching shells, logs, and git (e.g. a pre-commit hook or env-loading snippet).

Add a sequenced workflow with an explicit validation checkpoint (e.g. '1. load secret; 2. confirm it is not echoed; 3. run git diff --cached | grep -i <secret> before committing') to satisfy the destructive/batch validation requirement.

Collapse the Overview/When to Use/Instructions trio into one concise statement to remove the padding and raise conciseness.

DimensionReasoningScore

Conciseness

The same phrase ('secrets are never exposed in claude sessions, terminals, logs, or git commits') is restated verbatim across Overview, When to Use, and Instructions, padding the body with repetition that adds no new information — noticeably verbose rather than the lean anchor 5.

2 / 5

Actionability

The Instructions merely state the skill 'provides guidance and patterns' without any concrete commands, code, or specific steps, matching 'entirely vague or abstract; no concrete code or commands; only describes rather than instructs'.

1 / 5

Workflow Clarity

No steps or sequence are given for secure env var handling or git-commit safety, and there are no validation checkpoints despite git commits being a destructive/batch context; this matches 'steps missing or incoherent; no sequence; no validation'.

1 / 5

Progressive Disclosure

Section headers exist and an external repository link is provided, but the sections are near-empty and repetitive with no internal bundle structure; as a simple under-50-line skill this lands at 'some structure but could be better organized' rather than the clean 5.

3 / 5

Total

7

/

20

Passed

Description

53%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description states a clear purpose and outcome but lacks a 'Use when' trigger clause and concrete action verbs, capping several dimensions. It is distinct enough to avoid most conflicts but is not comprehensive.

Suggestions

Add an explicit 'Use when...' clause naming concrete triggers (e.g. 'Use when managing .env files, API keys, or credentials that must not leak into sessions, terminals, logs, or commits').

Replace the single outcome phrase with concrete actions the skill performs (load, mask, inject, validate) to lift specificity toward 5.

Include synonyms and file extensions users naturally say (env vars, .env, API keys, secrets, credentials) to broaden trigger-term coverage.

DimensionReasoningScore

Specificity

Quotes the domain ('environment variable management') and one outcome-oriented action ('ensuring secrets are never exposed'), but does not enumerate multiple concrete operations (e.g. load, mask, inject, validate), matching the 'names domain and 1-2 concrete actions' anchor rather than the multi-action anchor 5.

3 / 5

Completeness

Has a clear 'what' (secure env var management) but no 'Use when...' trigger clause; the rubric guideline caps completeness at 3 when explicit trigger guidance is missing, so it cannot reach 4.

3 / 5

Trigger Term Quality

Includes relevant natural terms ('environment variable', 'secrets', 'git commits', 'logs') but omits common synonyms and extensions users actually say (env vars, .env files, API keys, credentials), fitting 'some relevant keywords but missing common variations'.

3 / 5

Distinctiveness Conflict Risk

The niche (keeping secrets out of Claude sessions/terminals/logs/git) is fairly distinct from most skills with only minor overlap with general security tooling, fitting 'mostly distinct; minor overlap risk' above the broad anchor 3.

4 / 5

Total

13

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository
administrakt0r/AI-Agents-Safe-Coding-Skills
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.