Tessl • The management layer for AI agent skills

SkillPublic

audit

Use when you need a comprehensive code audit covering security, performance, architecture, and dependencies before a release, major refactor, or compliance review.

Quality

79%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/audit/SKILL.md

Quality

Content

73%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, largely executable audit workflow with explicit verification checkpoints and an unusually good anti-rationalization section. It loses points for re-explaining well-known concepts in the check tables and for uneven command coverage across the audit domains.

Suggestions

Trim the explanation columns in the check tables to bare check names where the criterion is standard knowledge (e.g., keep 'N+1 queries' but drop 'Database calls in loops'), retaining explanations only for project-specific criteria.

Add concrete detection commands for the Architecture step (e.g., npx madge --circular for import cycles) and the Performance step (e.g., grepping for addEventListener/setInterval without removal) to match the command coverage in Security and Observability.

Consider moving the per-domain check tables (security, accessibility, observability) into a references/ file and keeping SKILL.md focused on the workflow, scoring, and report format.

Dimension	Reasoning	Score
Conciseness	The workflow steps, bash commands, and scoring formula are tight, but the 'What to Look For' table columns re-explain concepts Claude already knows (e.g., 'N+1 queries: Database calls in loops', 'Color contrast: Text meets WCAG AA 4.5:1') and could be cut to check names alone.	3 / 5
Actionability	Provides copy-paste-ready bash (npm audit, targeted greps, frontend detection) plus a concrete scoring formula and output template, but the Architecture and Performance steps list criteria only, with no detection commands.	4 / 5
Workflow Clarity	Eight clearly sequenced steps with an explicit Verification Protocol checklist ('Before claiming audit is complete'), a defined scoring formula, and anti-rationalization guidance that includes a recovery path ('Scope down to critical paths (auth, payments, data)').	5 / 5
Progressive Disclosure	Well-organized sections (When to Use, Workflow, Severity Levels, Verification Protocol, Output) keep this single-pass audit self-contained with no nested references, though the per-domain check tables could be externalized to slim the file.	4 / 5
	Total	16 / 20 Passed

Description

78%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description that clearly states both what the skill does and when to use it, with genuinely natural trigger phrases tied to real scenarios. Its main weakness is leaning on one generic action verb plus coverage areas instead of enumerating the concrete actions performed, and it misses a few common trigger synonyms.

Suggestions

Replace the generic 'comprehensive code audit' with the concrete actions performed, e.g., 'Scans code for security vulnerabilities (OWASP Top 10), performance issues, architecture violations, and dependency CVEs, and produces a severity-scored report.'

Add one or two natural trigger synonyms users might say, such as 'technical debt' or 'pre-release check', to broaden keyword coverage without adding length.

Dimension	Reasoning	Score
Specificity	Names the domain (code audit) and its four coverage areas ('security, performance, architecture, and dependencies'), but relies on a single generic action verb ('audit') rather than listing several distinct concrete actions; 'comprehensive' is filler rather than substance.	3 / 5
Completeness	Explicitly answers both questions: what ('comprehensive code audit covering security, performance, architecture, and dependencies') and when ('Use when... before a release, major refactor, or compliance review') with concrete trigger scenarios rather than vague timing.	5 / 5
Trigger Term Quality	Natural phrases users would actually say are present ('code audit', 'security', 'release', 'major refactor', 'compliance review'), but common variants like 'code review', 'technical debt', or 'pre-release check' are missing, so coverage falls short of the top anchor.	4 / 5
Distinctiveness Conflict Risk	'Comprehensive code audit' with timing triggers (release/refactor/compliance) carves a mostly distinct niche, but the security and general code-analysis triggers overlap with dedicated security-review and code-review skills.	4 / 5
	Total	16 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
allowed_tools_field	'allowed-tools' contains unusual tool name(s)	Warning
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	14 / 16 Passed

Repository: fernandezbaptiste/specialist-agent
Path: skills/audit/SKILL.md
Revision: cd716d9

Reviewed: 8 days ago

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.

audit

Table of Contents

Is this your skill?