CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

cve-fix

Automated CVE remediation that reads vulnerability details from Jira vulnerability tickets, applies multi-strategy dependency fixes, validates results, and creates pull requests with full justification. Language-agnostic: supports Go, Node.js, Python, Java, Rust, Ruby. Use when patching CVEs, updating vulnerable dependencies, or responding to Jira vulnerability tickets. Activated by commands: /start, /scan, /patch, /validate, /pr, /backport, /close, /report.

Quality

79%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./cve-fix/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

61%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is admirably lean and its routing plus stop-on-failure rules are clearly written, but as an orchestrator skill it is only as good as its references — and every file it points to (commands/{command}.md, skills/controller.md, guidelines.md) is missing from the bundle, while the 15 existing scripts are never surfaced. The result is a well-formed index whose destinations do not resolve.

Suggestions

Include the referenced files in the bundle (commands/{command}.md, skills/controller.md, guidelines.md) or rewrite the body to point only at files that actually ship, so the routing instructions resolve.

Surface the scripts/ directory from SKILL.md — e.g., a short map of commands to executable entry points ('/scan' → 'python scripts/scan.py --ticket KEY-123') so guidance is executable without the missing markdown layer.

Add a minimal inline overview of the phase sequence (scan → patch → validate → PR) with the validation gate per phase, so the workflow's checkpoints are not solely delegated to absent files.

DimensionReasoningScore

Conciseness

The ~20-line body is a lean router: 'read `commands/{command}.md` and follow it', 'read `skills/controller.md`', 'see `guidelines.md`' — no padding, no explanation of concepts Claude already knows, and the error rule is stated in three tight sentences. Not 4: there is nothing to trim; every token directs behavior.

5 / 5

Actionability

The routing logic is concrete ('If the user invoked a specific command... read `commands/{command}.md` and follow it'), but the guidance is incomplete: the referenced files (commands/, skills/controller.md, guidelines.md) do not exist in the bundle, so following the instruction fails immediately, and the 15 scripts that do exist in scripts/ (scan.py, patch.py, create_pr.py, etc.) are never mentioned with an executable invocation. Not 4: 'mostly executable' fails because the primary instructions point at missing targets; not 2 because the conditional routing and error-handling behavior are specific, not high-level hints.

3 / 5

Workflow Clarity

A clear two-branch routing sequence exists plus an explicit failure checkpoint ('If a step fails or produces unexpected output, stop and report the error... Do not advance to the next phase. Offer to retry... or escalate'). However, the actual multi-phase workflow (scan → patch → validate → PR) is entirely delegated to files absent from the bundle, so the real sequence and its validation checkpoints are unavailable. Not 4: for a skill orchestrating dependency patching and PR creation (batch/destructive-adjacent operations), validation detail living in missing files leaves major gaps; not 2 because the steps that are written are coherent and a stop-on-failure rule is present.

3 / 5

Progressive Disclosure

Structurally the body is a clean one-level-deep overview ('read `commands/{command}.md`', 'read `skills/controller.md`', 'see `guidelines.md`'), but scored against the actual bundle: none of the three referenced targets exist (no commands/, skills/, or guidelines.md), while the large scripts/ directory that does exist is completely unreferenced and undiscoverable from the body. Not 3: the references are clearly signaled yet all dangling, making navigation to any detail impossible as shipped; not 1 because the overview itself is readable and well-organized rather than a monolithic wall of text.

2 / 5

Total

13

/

20

Passed

Description

88%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description: it states a concrete four-stage pipeline in third person, includes an explicit 'Use when' clause with specific triggers, and defines a distinct CVE/Jira remediation niche. The only weaknesses are unspecified 'multi-strategy' fixes and missing a few natural synonyms (e.g., 'security advisory') in the trigger terms.

DimensionReasoningScore

Specificity

Quotes: 'reads vulnerability details from Jira vulnerability tickets, applies multi-strategy dependency fixes, validates results, and creates pull requests with full justification' — four concrete actions covering the entire remediation pipeline comprehensively. Not 4: the actions span the full workflow (input, fix, validate, output) with no meaningful coverage gap, matching the 'comprehensive coverage' anchor rather than 'minor gaps'.

5 / 5

Completeness

Explicitly answers both: 'what' — the four-action remediation pipeline — and 'when' — 'Use when patching CVEs, updating vulnerable dependencies, or responding to Jira vulnerability tickets' with concrete trigger phrases, plus supported languages ('Go, Node.js, Python, Java, Rust, Ruby'). Not 4: the 'when' clause is not merely present but lists three specific, concrete triggers, matching the top anchor; third-person voice is used correctly.

5 / 5

Trigger Term Quality

Quotes: 'patching CVEs, updating vulnerable dependencies, or responding to Jira vulnerability tickets' — good natural-phrase coverage users would actually say. Not 5: common synonyms and tool-adjacent terms are missing (e.g., 'security vulnerability', 'security advisory', 'vuln', audit-tool names like Dependabot/Snyk); not 3 because the included terms are varied and natural rather than generic.

4 / 5

Distinctiveness Conflict Risk

Quotes: 'Automated CVE remediation', 'Jira vulnerability tickets' — a clear niche with distinct triggers unlikely to fire for unrelated skills. Not 5: the trigger 'updating vulnerable dependencies' creates minor overlap risk with generic dependency-management/update skills; not 3 because the Jira-vulnerability-ticket and CVE-patching combination is well differentiated from adjacent skills.

4 / 5

Total

18

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository

flightctl/ai-workflows

Path

cve-fix/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.