Tessl • The management layer for AI agent skills

SkillPublic

static-analysis

Skill de scan automatizado de codigo para vulnerabilidades, bugs e code smells via Semgrep e CodeQL. Use antes de toda release, em PRs grandes, ou quando suspeitar de classe de bug recorrente. Trigger em: "semgrep", "codeql", "static analysis", "scan de seguranca", "SAST", "varredura", "pre-deploy security", "OWASP scan", "CVE check", "auditoria automatizada".

Quality

85%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

81%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-sequenced skill body with concrete commands, a complete output template, and an explicit fix-rescan-revalidate feedback loop for batch scanning. Its main weakness is structural redundancy (handoff/integration restated across several sections) that inflates token cost without adding guidance.

Suggestions

Collapse the overlapping handoff/integration content: merge 'Evidencia de Conclusao', 'Handoff', and 'Integracao com Pipeline' into a single section so the handoff targets are stated once, cutting roughly 20-30 lines of repetition.

Reconcile 'Responsabilidades / Protocolo' (9 steps) and 'Pipeline Recomendado' (5 steps) into one canonical numbered workflow to remove the duplicated detect/select/run/triage/handoff steps.

Move the full output-format markdown template and the custom-rule YAML example into docs/skill-guides/static-analysis.md, keeping only a compact skeleton inline in SKILL.md to improve the progressive-disclosure split.

Dimension	Reasoning	Score
Conciseness	The body is operational and avoids explaining concepts Claude already knows, but handoff/integration points are restated across four sections ('Saidas Esperadas', 'Evidencia de Conclusao', 'Handoff', 'Integracao com Pipeline') and the 9-step 'Protocolo' overlaps the 5-step 'Pipeline Recomendado', so it could be tightened beyond a minor trim per anchor 3.	3 / 5
Actionability	Provides copy-paste-ready, fully executable guidance across common cases: install/run commands with exact flags, per-language ruleset lists, a complete custom-rule YAML, FP-suppression code, a full output-format template, and a CI YAML snippet, matching anchor 5.	5 / 5
Workflow Clarity	A clear 9-step Protocolo and 5-step Pipeline are backed by an explicit validation feedback loop ('Checkpoint por TP corregido': fix, rescan the file, confirm the original finding is gone AND no new finding appeared, fix any new finding before resolving), satisfying the batch-operation feedback-loop requirement and matching anchor 5.	5 / 5
Progressive Disclosure	SKILL.md acts as an overview and defers advanced rulesets/custom-rules/CI to docs/skill-guides/static-analysis.md and subagent specifics to .claude/agents/*.md as one-level-deep, clearly signaled references, but the full output template and custom-rule example are inlined and the referenced files cannot be verified against a (non-existent) bundle, leaving minor organization gaps per anchor 4.	4 / 5
	Total	17 / 20 Passed

Description

86%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, well-structured description that explicitly covers what the skill does, when to use it, and a comprehensive set of natural trigger phrases with synonyms. Its only relative weakness is that it expresses a single concrete action and shares some generic security triggers with a closely related review skill.

Dimension	Reasoning	Score
Specificity	Names the domain, detection targets (vulnerabilidades, bugs, code smells), and concrete tools (Semgrep, CodeQL), but describes a single action (scan) rather than several distinct actions, matching anchor 3 and falling short of anchor 4's 'several specific actions'.	3 / 5
Completeness	Explicitly answers both 'what' (scan via Semgrep/CodeQL for vulnerabilities/bugs/code smells) and 'when' ('Use antes de toda release, em PRs grandes, ou quando suspeitar de classe de bug recorrente') plus concrete trigger phrases, matching anchor 5.	5 / 5
Trigger Term Quality	The explicit 'Trigger em:' list covers tool names plus synonyms users naturally say (SAST, static analysis, varredura, scan de seguranca, OWASP scan, CVE check), giving comprehensive natural-term coverage with synonyms per anchor 5.	5 / 5
Distinctiveness Conflict Risk	The tool-specific triggers (semgrep, codeql, SAST) carve a clear niche, but generic security terms (scan de seguranca, OWASP scan, auditoria) carry minor overlap risk with a sibling manual Security Review skill, matching anchor 4 rather than a clean anchor 5.	4 / 5
	Total	17 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
allowed_tools_field	'allowed-tools' contains unusual tool name(s)	Warning
metadata_version	'metadata.version' is missing	Warning

	Total	14 / 16 Passed

Repository: felvieira/claude-skills-fv
Path: skills/34-static-analysis/SKILL.md
Revision: 449fb53

Reviewed: 2 months ago

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.

static-analysis

Table of Contents

Is this your skill?