CtrlK
BlogDocsLog inGet started
Tessl Logo

security-scan

对进入系统的文件或 URL 执行安全与合规扫描,输出 pass/reject 判定与扫描报告,作为所有文档处理的强制前置关卡。

59

Quality

69%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./antinet-agentteams/skills/security-scan/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

75%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is well-structured, concise, and actionable with a real referenced script, clear I/O contract, and explicit failure-handling policy. It is held back from top marks by partial on-page execution detail and the lack of an explicit validate-retry loop.

Suggestions

Add an explicit validate-then-retry workflow (e.g., on file-type ambiguity: probe -> if unknown, reject -> log -> alert admin) to push workflow clarity to 5.

Inline a minimal concrete scan snippet or the key blacklist/license check call so the skill is executable without leaving SKILL.md.

Tighten the '复用价值' section to pure guidance and move any reusable-policy detail to a referenced file to improve conciseness.

DimensionReasoningScore

Conciseness

The body is sectioned and mostly lean — inputs, outputs, dependencies, failure handling — without padding concepts Claude already knows; only minor phrasing could be trimmed (e.g., the '复用价值' section edges toward explanation).

4 / 5

Actionability

Provides a concrete runnable entry point ('python skills/security-scan/scripts/run_security_scan.py') and lists concrete inputs/outputs and dependencies, with minor gaps — the actual scan logic lives in the referenced JinYiWeiAgent, so on-page execution detail is partial.

4 / 5

Workflow Clarity

Inputs, outputs, and failure-handling branches are clearly laid out with a zero-trust 'reject rather than degrade' rule, and failure paths act as validation checkpoints; it falls short of 5 because there is no explicit validate-then-retry loop for the recoverable cases.

4 / 5

Progressive Disclosure

Well-organized sections with a single clearly signaled one-level-deep reference to the runnable script in ./scripts/ (verified to exist), plus named external artifacts (provenance/太史阁, output JSON); only minor organization gaps since the scan internals are not further split out.

4 / 5

Total

16

/

20

Passed

Description

63%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description clearly communicates what the skill does and its role as a mandatory gate, with concrete actions and a distinct niche. Its main weakness is the absence of an explicit 'Use when...' trigger clause and thinner natural-keyword coverage.

Suggestions

Add an explicit trigger clause such as 'Use when a file or URL enters the document pipeline and must pass security/compliance screening before further processing'.

Broaden natural trigger terms — include synonyms like '黑名单检查', '安全审查', '来源拦截', and file extensions (PDF/PPT/Excel/Word) users would mention.

Tighten distinctiveness by naming the specific checks (domain blacklist, OA license validation) so it is unambiguously the security-gate skill.

DimensionReasoningScore

Specificity

Names concrete actions — '执行安全与合规扫描' and '输出 pass/reject 判定与扫描报告' — and the target set (文件/URL), giving specific coverage with only minor gaps (e.g., license/blacklist specifics live in the body).

4 / 5

Completeness

Clear 'what' (security/compliance scan with pass/reject verdict) and a usable 'when' ('作为所有文档处理的强制前置关卡'), but the when-clause is implicit rather than an explicit 'Use when...' trigger phrase, so it stops just short of 5.

4 / 5

Trigger Term Quality

Contains relevant terms like '安全扫描', '合规扫描', 'pass/reject', and '文件或 URL', but lacks natural synonyms and concrete extensions a user would say (e.g., '黑名单', '安全审查', '拦截', '.pdf'); missing common variations.

3 / 5

Distinctiveness Conflict Risk

The role as a mandatory pre-processing security gate with pass/reject verdicts carves a distinct niche with minimal overlap risk against general document skills; only minor overlap with adjacent compliance/audit skills keeps it from 5.

4 / 5

Total

15

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository
anbeime/skill
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.