CtrlK
BlogDocsLog inGet started
Tessl Logo

varlock

Secure-by-default environment variable management for Claude Code sessions.

44

Quality

45%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./plugins/AI-Agents-Safe-Coding-Skills-claude/skills/varlock/SKILL.md

The canonical home for this skill is varlock in administrakt0r/AI-Agents-Safe-Coding-Skills

SKILL.md
Quality
Evals
Security

Quality

Content

50%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with concrete commands and examples, but is verbose due to heavy duplication across sections and lacks a cohesive validation feedback loop. With no bundle files, all reference material is inlined into one long document.

Suggestions

De-duplicate the safe-command and 'never do' guidance — keep it in one canonical section (e.g., the Quick Reference Card) and reference it elsewhere rather than restating it in Rules, Safe Commands, and tables.

Add an explicit validate→fix→retry feedback loop for the core destructive flows (e.g., secret rotation and schema validation) so workflow clarity reaches the gated checkpoint pattern.

Move the bulk reference material (full schema/type annotation tables, troubleshooting, external-source integrations) into separate reference files and link to them one level deep to reduce the inline token load.

DimensionReasoningScore

Conciseness

Noticeably verbose: safe commands and 'never do' rules are repeated across the Rules, Safe Commands, Quick Reference Card, and Never-Do table, plus padded scripted 'Claude should respond' blocks — fitting 'Noticeably verbose; several unnecessary... padded sections.'

2 / 5

Actionability

Abundant concrete, executable commands (varlock load/run, install, schema annotations, npm scripts, Dockerfile, CI yaml) cover common cases copy-paste ready, with only minor gaps, matching 'Mostly executable guidance; concrete code or commands with minor gaps.'

4 / 5

Workflow Clarity

Patterns are sequenced with some validation (Pattern 1 exits on invalid; rotation validates via varlock load), but flows are scattered and lack a cohesive validate→fix→retry feedback loop, fitting 'Steps listed but validation gaps; checkpoints missing or implicit.'

3 / 5

Progressive Disclosure

No bundle files exist and the skill is monolithic (~430 lines); it is well-sectioned but content that could live in separate files (full schema/type reference, troubleshooting, integration guides) is fully inline with no file references.

3 / 5

Total

12

/

20

Passed

Description

41%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description states a clear, fairly distinctive purpose but omits any explicit trigger guidance and relies on a single generic keyword. It reads as a capability statement rather than a discoverable, when-to-use prompt.

Suggestions

Append an explicit trigger clause, e.g. 'Use when managing environment variables or secrets in Claude Code sessions, or when the user mentions .env files, API keys, or secret rotation.'

Add concrete action verbs (validate, mask, inject, rotate) so the description conveys what the skill actually does rather than only the domain.

Include natural synonyms users say — 'secrets', '.env', 'API keys', 'tokens' — to improve keyword coverage and discoverability.

DimensionReasoningScore

Specificity

Names the domain ('environment variable management') and the 'secure-by-default' property, but lists no concrete actions like validate, mask, or inject — matching 'Names the domain but actions are minimal or generic.'

2 / 5

Completeness

A clear 'what' is present ('Secure-by-default environment variable management for Claude Code sessions') but there is no 'Use when...' or equivalent trigger guidance, so completeness is capped at 3 per the rubric.

3 / 5

Trigger Term Quality

Only 'environment variable' is a natural user keyword; common phrases users actually say ('secrets', '.env', 'API keys') are absent, fitting 'One or two generic keywords; missing the natural phrases users say.'

2 / 5

Distinctiveness Conflict Risk

The security-focused env-var-management-for-Claude-Code niche is mostly distinct with only minor overlap risk against a general secrets-management skill, matching 'Mostly distinct; minor overlap risk.'

4 / 5

Total

11

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository
administrakt0r/AI-Agents-Safe-Coding-Skills
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.