Tessl • The management layer for AI agent skills

SkillPublic

quality-security-loop

Use when closing a Python coding task, choosing quality or security checks, or deciding whether the agent delivery loop still needs another pass on a data-platform change.

Quality

76%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./.apm/skills/quality-security-loop/SKILL.md

Quality

Content

88%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a model of lean, actionable instruction: a diff-driven tool map, concrete runner commands, and a tightly sequenced close-out loop with explicit failure handling and stopping rules. The only weaknesses are deferral of check details to external files and one vaguely signaled reference.

Dimension	Reasoning	Score
Conciseness	The body is lean with zero padding: every line is either an instruction, a tool mapping, or a labeled pointer ("Fonte da verdade (não copie o texto dessas páginas; abra e sega)") and it assumes Claude's competence throughout.	5 / 5
Actionability	Concrete commands (`python3 scripts/agent_loop.py`, `apm run lint/test/audit`) and a specific diff-to-tool map (Ruff, mypy, Bandit, gitleaks, pip-audit, Trivy) plus a routing rule to `schemathesis-api`; minor gap in that check arguments and thresholds are deferred to external `loop.yaml` and docs not shown here.	4 / 5
Workflow Clarity	The 8-step close-out sequence has explicit validation checkpoints and feedback loops: constrained failure feedback (`propriedade_quebrada`, `contraexemplo_minimo`), discard on repeated failure hash, a hard 3-iteration limit, and closure only when failures pass and prior passes hold.	5 / 5
Progressive Disclosure	A concise overview points one level deep to clearly labeled sources (`docs/qualidade-seguranca.md`, `docs/agent-delivery-loop.md`, `loop.yaml`), but `docs/papers-research.md` is cited only as "Fonte extra" with no stated relevance, and none of the referenced files ship in the skill's own bundle.	4 / 5
	Total	18 / 20 Passed

Description

53%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description has an explicit, well-targeted trigger clause but is composed entirely of when-guidance; it never states the skill's concrete capabilities or tools, leaving the "what" implied. Keywords are serviceable but miss common synonyms and the tool names that would make retrieval natural.

Suggestions

Add an explicit capability statement before the trigger, e.g. 'Runs quality and security checks (Ruff, mypy, Bandit, gitleaks, pip-audit, Trivy) and drives the agent delivery loop to closure on data-platform changes.'

Include natural synonym keywords users would say, such as 'lint', 'audit', 'security review', or 'CI checks', alongside the existing 'quality or security checks'.

Replace or gloss project jargon like 'agent delivery loop' with a plain-language equivalent so users outside the team can still match the trigger.

Dimension	Reasoning	Score
Specificity	Names the domain ("Python coding task", "data-platform change") and 1-2 concrete actions ("choosing quality or security checks", "deciding whether the agent delivery loop still needs another pass"), but does not enumerate the skill's actual capabilities or tool names, so coverage is not comprehensive.	3 / 5
Completeness	The "Use when..." trigger is explicit, but the entire description is trigger guidance with no explicit statement of what the skill does; the "what" (running checks, closing the loop) is only implied through the when-clauses, fitting between anchors 3 and 4.	3 / 5
Trigger Term Quality	Natural phrases like "quality or security checks" and "another pass" are present, but common variations users would say (lint, audit, security review, CI) and the tool names the skill actually orchestrates are missing, and "agent delivery loop" is project jargon.	3 / 5
Distinctiveness Conflict Risk	The "agent delivery loop" and "data-platform" framing carves a distinct niche, though "closing a Python coding task, choosing quality or security checks" retains minor overlap risk with generic code-review and lint skills.	4 / 5
	Total	13 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
referenced_paths_exist	Referenced path issues: 4 missing	Warning

	Total	15 / 16 Passed

Repository: fazedordecodigo/python-api-validation-discovery
Path: .apm/skills/quality-security-loop/SKILL.md
Revision: 666a9ac

Reviewed: 14 days ago

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.

quality-security-loop

Table of Contents

Is this your skill?