CtrlK
BlogDocsLog inGet started
Tessl Logo

secret-handling

Never read .env files or write secrets to .squad/ committed files

60

Quality

71%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./.copilot/skills/secret-handling/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

85%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with concrete code, regex tables, and well-sequenced validation workflows supported by explicit feedback loops. Its main weakness is mild verbosity from repeated emphasis and large inline alert blocks.

Suggestions

Tighten the repeated NEVER emphasis and consolidate the inline alert blocks into a single reusable template to reduce token cost.

Condense the .env file enumeration into a compact glob rule plus the allowed-alternatives list to avoid listing every environment variant.

DimensionReasoningScore

Conciseness

Mostly efficient and actionable, but repeats the prohibition emphasis across file lists, tables, and large inline alert blocks that could be tightened without losing meaning.

2 / 3

Actionability

Provides concrete regex patterns, executable commands (git reset HEAD, git diff --cached), and a complete PowerShell validation script that is copy-paste ready.

3 / 3

Workflow Clarity

The pre-commit validation and remediation flows are clearly sequenced with explicit validation checkpoints and STOP/exit-on-error feedback loops for risky operations.

3 / 3

Progressive Disclosure

A single well-organized SKILL.md with clearly labeled sections (Context, Patterns, Examples, Anti-Patterns) and no unnecessary external references; content is appropriately inline for a skill of this size.

3 / 3

Total

11

/

12

Passed

Description

57%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and distinct within a clear security niche, but is framed purely as prohibitions and omits any 'Use when...' trigger guidance. Adding explicit trigger conditions and broader secret-related keywords would raise it.

Suggestions

Add a 'Use when...' clause stating when to apply this skill, e.g. 'Use when handling .env files, credentials, or committing .squad/ changes that may contain secrets.'

Broaden trigger terms to include 'credentials', 'API keys', 'passwords', and 'tokens' that users would naturally say.

Complement the prohibitions with positive capability phrasing so the 'what' covers both what to avoid and what to do instead.

DimensionReasoningScore

Specificity

Names the security/file-operations domain and concrete actions ('read .env files', 'write secrets to .squad/ committed files') but only as prohibitions, not a comprehensive list of capabilities.

2 / 3

Completeness

States what the skill prohibits but lacks any 'Use when...' trigger clause, so the 'when' dimension is only implied — capping completeness at 2 per the guidelines.

2 / 3

Trigger Term Quality

Includes relevant keywords ('.env', 'secrets', '.squad/') but misses common variations a user would say like 'credentials', 'API keys', 'passwords', or 'tokens'.

2 / 3

Distinctiveness Conflict Risk

A clear niche (preventing secret leaks via .squad/ commits) with distinct triggers unlikely to conflict with other skills.

3 / 3

Total

9

/

12

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository
bradygaster/squad
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.