Tessl • The management layer for AI agent skills

Blog Docs Log inGet started

SkillPublic

permissions

Command approvals, tool policies, and exec security

Quality

67%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./src/skills/bundled/permissions/SKILL.md

Quality

Content

70%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a thorough, executable reference with strong actionability and good token efficiency, but it presents the entire API surface inline with no progressive disclosure into bundle files and omits validation checkpoints for its approval/blocked-command workflows.

Suggestions

Move the bulk TypeScript API reference into a references/ file (e.g. REFERENCE.md) and keep only a quick-start example plus clearly signaled links in SKILL.md to improve progressive disclosure.

Add an explicit validation/verification step to the approval workflow, e.g. after blocking a pattern, confirm via list/check that the command is now denied, with a fix-and-retry loop on failure.

Trim redundant inline comments on code blocks (e.g. '// Approve request', '// Add allow rule') that merely restate the heading.

Dimension	Reasoning	Score
Conciseness	The body is mostly efficient reference material with runnable code blocks and tables, and avoids explaining concepts Claude already knows; minor padding such as repeated inline comments ('Approve request', 'Add allow rule') keeps it just below the lean anchor.	4 / 5
Actionability	It provides copy-paste-ready TypeScript and bash snippets covering the common cases — manager creation, check/approve/reject, rule management, tool policies, and CLI usage — with concrete option values and result fields, matching the fully executable anchor.	5 / 5
Workflow Clarity	Although sections are well organized, the approval and rule workflows involve approval-requiring and potentially destructive operations yet include no explicit validation checkpoint or feedback loop (e.g. verify a blocked command was actually denied), which caps workflow_clarity at 3 per the destructive/batch cap.	3 / 5
Progressive Disclosure	The SKILL.md inlines roughly 270 lines of complete API reference with section headers but no bundle files exist (references/, scripts/, assets/ are empty) and nothing is split into a separate file, so content that clearly belongs in a REFERENCE.md is inlined rather than referenced one level deep.	3 / 5
	Total	15 / 20 Passed

Description

51%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description states the skill's domain clearly but stops short of explicit trigger guidance and concrete actions, leaving the 'when to use' question unanswered. It is concise and third-person but lacks the natural trigger phrases that would make it discoverable.

Suggestions

Add an explicit 'Use when...' clause naming concrete triggers, e.g. 'Use when the user asks to approve, allow, or block commands, restrict agent tool access, or review approval history.'

List one or two concrete actions (e.g. 'check, approve, and reject command execution') to lift specificity toward the comprehensive anchor.

Include natural synonyms users actually say (e.g. 'allowlist', 'blocklist', 'approve a command') to broaden trigger-term coverage.

Dimension	Reasoning	Score
Specificity	The description names three concrete capability areas — 'command approvals', 'tool policies', and 'exec security' — but does not list specific actions such as checking, approving, or blocking, so coverage is moderate rather than comprehensive.	3 / 5
Completeness	The 'what' is present (manages approvals, policies, and security controls) but there is no 'Use when...' clause or equivalent trigger guidance, capping completeness at 3 per the rubric.	3 / 5
Trigger Term Quality	It surfaces domain-relevant keywords ('permissions', 'command', 'tool access', 'security') but omits the natural phrases a user would say ('approve a command', 'allow npm', 'block rm -rf') and any synonyms, so keyword coverage is only partial.	3 / 5
Distinctiveness Conflict Risk	The 'permissions' niche with command approvals and exec security is reasonably distinct from most other skills, with only minor overlap risk against a generic security tool; it is not a fully clear niche because the wording stays somewhat broad.	4 / 5
	Total	13 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: alsk1992/CloddsBot
Path: src/skills/bundled/permissions/SKILL.md
Revision: c930628

Reviewed: 1 month ago

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.

permissions

Table of Contents

Is this your skill?