secret-handling

Never read .env files or write secrets to .squad/ committed files

Quality

63%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./.copilot/skills/secret-handling/SKILL.md

Quality

Content

81%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with executable scanning code, explicit validation checkpoints, and clear error-recovery feedback loops for a destructive operation. It is well-structured and self-contained, with only minor conciseness bloat from repeated templated error blocks.

Dimension	Reasoning	Score
Conciseness	Mostly efficient and assumes Claude's competence, but the repeated emoji error-message blocks and the duplicated prohibition/anti-pattern lists add padding that could be trimmed without losing clarity.	3 / 5
Actionability	Provides concrete executable guidance — a regex scanning table, a ready-to-run PowerShell validation snippet, explicit git commands, and copy-paste-style error report templates covering the common cases.	5 / 5
Workflow Clarity	The Scribe pre-commit validation and remediation workflows are explicitly sequenced with validation checkpoints (scan -> block -> reset staging -> report), feedback loops (stop, alert, wait for user), and a clear 'fail loud' error-recovery path for a destructive operation.	5 / 5
Progressive Disclosure	Well-organized sections (Context, Patterns, Examples, Anti-Patterns) with no external bundle files present; content is appropriately inlined for a self-contained skill, though the large regex/error-block detail could conceptually be split out.	4 / 5
	Total	17 / 20 Passed

Description

45%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description names a specific, distinct niche (secrets vs .squad/ committed files) but is terse and lacks any 'Use when...' trigger guidance, which caps its completeness. It is adequate but underspecified for triggering purposes.

Suggestions

Add an explicit trigger clause, e.g. 'Use when spawning agents that may touch .env files or when Scribe is about to commit .squad/ changes.'

Expand the what with concrete verbs users say — 'detect and block leaked credentials, scan staged files for secret patterns'.

Include common synonyms such as 'credentials', 'API keys', 'tokens', and 'commit' so natural phrasings match.

Dimension	Reasoning	Score
Specificity	Names two concrete prohibited/allowed actions ('read .env files', 'write secrets to .squad/ committed files') but is not comprehensive — it omits scanning, remediation, and validation which the body covers.	3 / 5
Completeness	The 'what' is stated (prohibitions on .env reads and secret writes) but there is no 'Use when...' clause or equivalent trigger guidance, capping completeness at 3; with only a weak implied 'when', it sits below the midpoint at 2.	2 / 5
Trigger Term Quality	Contains relevant terms ('.env', 'secrets', '.squad/') but lacks common natural phrasings users would say (e.g. 'credentials', 'API keys', 'commit') and offers no synonyms.	3 / 5
Distinctiveness Conflict Risk	The combination of '.env files' and '.squad/ committed files' carves a clear, narrow niche with minimal overlap against generic file skills, though it could still brush against a broader security skill.	4 / 5
	Total	12 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: bradygaster/squad
Path: .copilot/skills/secret-handling/SKILL.md
Commit: c41b316

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.