CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

confidentiality-review

Flag customer, prospect, partner, or outside-person identities in the diff. Reported in the Warden security summary.

59

Quality

74%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./.warden/skills/confidentiality-review/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

82%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is an exemplary lean, instruction-dense skill: untrusted-input handling, precise flag/ignore rules, output-format constraints, and escalation logic with no wasted tokens. Its remaining gaps are the absence of a concrete example finding, an unspecified escalation procedure, and a missing heading for the core flagging rules.

Suggestions

Add a compact example finding showing the required output shape (file/line location, generic description, remediation, 'Clear when:').

Give the core flagging rules their own heading (e.g. '## What to flag') instead of leaving them under '## Untrusted input'.

Make the escalation action concrete — state where and how an already-public identity should be escalated.

DimensionReasoningScore

Conciseness

The body is dense task-defining instruction with zero padding and no explanation of concepts Claude already knows; every sentence ('Never quote, paraphrase, or otherwise reproduce identity content') earns its place, matching the lean-and-efficient anchor.

5 / 5

Actionability

Guidance is concrete — an explicit ignore list ('vendors named as technology, the team itself, fictional fixtures, and removed lines'), a grouping rule, and a required 'Clear when:' field — but no example finding shows the required output shape, so edge cases (customer-as-vendor, license headers) are left to judgment rather than covered by examples.

4 / 5

Workflow Clarity

The single review action is unambiguous with an explicit validation checkpoint ('Check contrary evidence before reporting'), and the destructive/batch cap does not apply; it falls short of 5 because 'escalate it' specifies no concrete escalation procedure and the rules are presented as prose rather than a sequence.

4 / 5

Progressive Disclosure

At 24 lines with no external references needed, 5 is reachable through well-organized sections alone; however the core flagging rules sit in an unlabeled paragraph under the mislabeled '## Untrusted input' header, a minor organization gap matching anchor 4.

4 / 5

Total

17

/

20

Passed

Description

53%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description states a clear, single concrete action in a distinct niche, but it has no trigger guidance ('Use when...') and misses common synonyms like PII or confidential, leaving a user relying on it little basis to know when to invoke the skill. It is well above vague one-liners yet clearly below the exemplar descriptions that pair what-and-when with rich trigger terms.

Suggestions

Add an explicit 'when' clause, e.g. 'Use when reviewing a diff, PR, or security summary for confidential identity disclosures.'

Include natural trigger synonyms users would say — 'PII', 'confidential information', 'personal names', 'customer names' — alongside the existing identity terms.

Briefly state what the skill does with findings (report file/line locations without quoting content) so the 'what' covers the full capability, not just detection.

DimensionReasoningScore

Specificity

Names the domain ("identities in the diff") and one concrete action ("Flag"), matching the '1-2 concrete actions, not comprehensive' anchor; the 'Reported in the Warden security summary' clause describes output destination rather than an additional action, so it does not reach the several-actions level.

3 / 5

Completeness

The 'what' is clear (flag identity disclosures in the diff), but there is no 'Use when...' clause or equivalent trigger guidance, which caps completeness at 3 per the judging guidelines.

3 / 5

Trigger Term Quality

Relevant natural keywords like 'customer', 'partner', 'identities', and 'diff' are present, but common variations users would say — 'PII', 'confidential', 'personal information', 'names' — are missing, matching the 'some relevant keywords but missing synonyms' anchor.

3 / 5

Distinctiveness Conflict Risk

The enumerated target set (customer/prospect/partner/outside-person) and the anchored output channel ('Warden security summary') carve a mostly distinct niche with only minor overlap risk against closely related skills like generic PII scanning; it lacks the fully distinct trigger phrases needed for a 5.

4 / 5

Total

13

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

different-ai/openwork

Path

.warden/skills/confidentiality-review/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.