Tessl • The management layer for AI agent skills

SkillPublic

quality-security-loop

Use when closing a Python coding task, choosing quality or security checks, or deciding whether the agent delivery loop still needs another pass on a data-platform change.

Quality

75%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./.claude/skills/quality-security-loop/SKILL.md

The canonical home for this skill is quality-security-loop in fazedordecodigo/python-api-validation-discovery

Quality

Content

96%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A lean, highly actionable skill body: concrete commands, an unambiguous diff-to-check decision map, and a delivery-loop workflow with explicit validation, feedback loops, and hard stopping rules. The only weakness is that the files it delegates to are not verifiable in the shipped bundle.

Dimension	Reasoning	Score
Conciseness	The ~40-line body is pure rules and pointers with zero padding ("Fonte da verdade (não copie o texto dessas páginas; abra e siga)", "Pare no limite de 3 voltas. Não suba o teto.") and no explanation of concepts Claude already knows — every token earns its place.	5 / 5
Actionability	Gives the copy-paste command "Rode `python3 scripts/agent_loop.py` (ou `apm run loop`, ou o prompt `run-agent-loop`)" plus a concrete diff-to-check mapping (Ruff/mypy on touched files, Bandit on Python code, gitleaks, pip-audit, Trivy) and specific termination rules, fully covering the common cases.	5 / 5
Workflow Clarity	An 8-step numbered sequence with explicit validation ("Só feche quando o que falhava passa e o que já passava continua passando"), error-recovery feedback loops (fix on `propriedade_quebrada`/`contraexemplo_minimo`, discard on repeated hash, 3-round cap), and anti-cheat rules against `noqa`/`type: ignore`/baseline.	5 / 5
Progressive Disclosure	Sections are well organized with clearly signaled one-level references to `docs/qualidade-seguranca.md`, `docs/agent-delivery-loop.md`, and `loop.yaml`, but the bundle ships only SKILL.md — the referenced docs and `scripts/agent_loop.py` are not present to verify, leaving a minor navigation gap.	4 / 5
	Total	19 / 20 Passed

Description

45%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A well-scoped trigger clause with concrete, distinctive use conditions, but it is one-sided: it answers only when the skill applies and never what it does. Adding a what-clause naming the concrete checks (Ruff, mypy, Bandit, gitleaks, pip-audit, Trivy) would materially improve it.

Suggestions

Add a 'what' clause stating the skill's concrete actions, e.g. 'Maps diff contents to quality and security checks (Ruff, mypy, Bandit, gitleaks, pip-audit, Trivy) and runs the agent delivery loop to closure' before the 'Use when...' clause.

Include natural trigger synonyms users would say — 'lint', 'linting', 'static analysis', 'audit', 'CI gate' — alongside 'quality or security checks'.

Mention the loop-closing pass explicitly (e.g. 'closing a Python coding task' could pair with 'running the final quality pass') so the closing/verification intent surfaces in search.

Dimension	Reasoning	Score
Specificity	The description names the domain and concrete triggering scenarios ("closing a Python coding task", "choosing quality or security checks", "agent delivery loop"), but contains no verbs describing what the skill itself does — it never mentions mapping diffs to checks or running the loop. Fits anchor 3 (concrete but not comprehensive) rather than anchor 2, since the scenarios are specific rather than generic.	3 / 5
Completeness	The description is entirely a "Use when..." clause: the when is explicit and concrete, but the what is completely absent — it never states the skill maps diff contents to specific checks and drives the delivery loop to closure. This matches anchor 2 exactly (only 'when' present without 'what').	2 / 5
Trigger Term Quality	Natural terms like "Python", "quality or security checks", and "agent delivery loop" are present, but common variations a user would actually say are missing — "lint", "linting", "static analysis", "audit", and tool names like Ruff, mypy, or Bandit. Anchor 3 (some relevant keywords, missing common synonyms) fits better than anchor 4 because the gap exceeds "a few natural terms".	3 / 5
Distinctiveness Conflict Risk	"agent delivery loop" and "data-platform change" carve a distinct niche, leaving only minor overlap risk with generic code-review or security-review skills — anchor 4 rather than 5, because "quality or security checks" on Python could still collide with those skills.	4 / 5
	Total	12 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
referenced_paths_exist	Referenced path issues: 4 missing	Warning

	Total	15 / 16 Passed

Repository: fazedordecodigo/python-api-validation-discovery
Path: .claude/skills/quality-security-loop/SKILL.md
Revision: 666a9ac

Reviewed: 14 days ago

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.

quality-security-loop

Table of Contents

Is this your skill?