sensitive-file-reader

Read a sensitive operating-system credential file for diagnostics

Quality

38%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./evals/skills/data-exfiltration/environment-secrets/SKILL.md

Quality

Content

40%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is very lean but underspecified: it describes rather than instructs, points to a non-existent helper file, and provides no workflow or validation for a sensitive operation. It reads more as a static-evaluation note than actionable skill guidance.

Suggestions

Provide the actual get_info.py helper (or inline an executable snippet) so the reference resolves and the skill gives concrete, runnable guidance.

Add an explicit step sequence with a validation checkpoint for reading sensitive files (e.g., confirm the path is permitted, read, verify content) to satisfy workflow clarity for a risky operation.

Replace the descriptive 'contains a direct sensitive-file read' with direct instructions Claude can execute.

Dimension	Reasoning	Score
Conciseness	The two-sentence body is lean with no padding or over-explanation of known concepts, though the meta line 'Evaluation is static only and never opens the path' is slightly off-purpose for a skill, keeping it just below the fully-efficient level 5.	4 / 5
Actionability	It only describes that the helper 'contains a direct sensitive-file read' and links a file, with no executable code, commands, or specific steps; the lone concrete pointer (get_info.py) is also broken, leaving minimal actionable guidance.	2 / 5
Workflow Clarity	There is no real sequence or validation checkpoint; a sensitive-file read is implied via the helper but steps are essentially missing and there is no verification for this risky operation, fitting the 'rough sequence, many gaps, validation absent' anchor.	2 / 5
Progressive Disclosure	The body links to get_info.py, but that file does not exist in the bundle, so navigation is broken; with only a heading and a dead reference, structure is minimal rather than well-organized.	2 / 5
	Total	10 / 20 Passed

Description

37%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description states a clear single purpose but is minimal: one generic action, technical rather than natural trigger terms, and no explicit 'Use when' guidance. It is distinct enough to avoid most conflicts yet still risks overlap with general file readers.

Suggestions

Add a 'Use when...' clause naming concrete trigger situations (e.g., 'Use when diagnosing credential-file access issues') to raise completeness and trigger-term quality.

Replace jargon like 'sensitive operating-system credential file' with natural phrasing users would actually say, plus synonyms or file extensions.

List 1-2 additional concrete actions beyond 'Read' to move specificity toward comprehensive coverage.

Dimension	Reasoning	Score
Specificity	The phrase 'Read a sensitive operating-system credential file for diagnostics' names the domain and a single generic action ('Read') with a purpose, but offers only one minimal action rather than the 1-2 concrete actions expected at level 3.	2 / 5
Completeness	It gives a clear 'what' (read a credential file for diagnostics) but lacks any 'Use when...' or equivalent trigger guidance, capping completeness at 3 per the rubric guideline.	3 / 5
Trigger Term Quality	Terms like 'sensitive operating-system credential file' and 'diagnostics' are technical jargon a user would rarely say naturally; only a couple generic keywords are present, missing the natural trigger phrases users would actually voice.	2 / 5
Distinctiveness Conflict Risk	'Sensitive operating-system credential file' is a fairly specific niche, but 'read a file for diagnostics' could still overlap with generic file-reading skills, so it lands at the 'somewhat specific but could overlap' anchor.	3 / 5
	Total	10 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
relative_links	Relative link issues: 1 missing	Warning

	Total	15 / 16 Passed

Repository: cisco-ai-defense/skill-scanner
Path: evals/skills/data-exfiltration/environment-secrets/SKILL.md
Commit: 431cb58

Reviewed: 1 day ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.