CtrlK
BlogDocsLog inGet started
Tessl Logo

credentials

Instructions for handling API keys and credentials safely, verifying their presence, and prompting the user to add them if missing using a safe protocol.

64

Quality

76%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/credentials/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

85%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable with executable verification and prompting commands and a clear gated workflow that includes an explicit validation checkpoint. The main weakness is redundant restatement of the critical failure-handling rule, which could be tightened without losing clarity.

Suggestions

Consolidate the repeated failure-handling guidance into one clearly marked critical block instead of restating it across the bullet, the `> [!CRITICAL]` callout, and the "NEVER run" line.

Move the "NEVER run cat ~/.env, grep without -q, echo $VAR, printenv" list adjacent to the verification command so the do-and-don't sit together.

Consider a short numbered checklist at the top (verify → branch → prompt or proceed → run script) so the gated workflow is scannable before the detail.

DimensionReasoningScore

Conciseness

The body is mostly lean and actionable, but the failure-handling rule is restated in the bullet, the `> [!CRITICAL]` block, and the "NEVER run" line, which could be consolidated.

2 / 3

Actionability

It gives fully executable commands (`grep -sq "^CREDENTIAL_NAME=" ~/.env` and the `printf…read -s…` template) with explicit placeholder-substitution steps, matching the copy-paste-ready anchor.

3 / 3

Workflow Clarity

A clear gated sequence — verify via exit code, then branch to proceed or prompt the user, then run scripts — with an explicit validation checkpoint; no destructive/batch cap applies.

3 / 3

Progressive Disclosure

A single cohesive protocol with well-organized sections and no nested or external references, so the one-file structure is appropriate and easy to navigate.

3 / 3

Total

11

/

12

Passed

Description

67%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and distinct, naming three concrete credential-handling actions in third person, but it omits an explicit "Use when..." trigger clause and relies on a narrow set of trigger terms. Adding when-to-use guidance and a few more natural keywords would lift completeness and trigger quality.

Suggestions

Append an explicit trigger clause, e.g. "Use when a skill needs an API key or credential and you must verify it is set without leaking its value."

Broaden trigger terms to include natural variations users say, such as "API keys, secrets, tokens, .env files, credentials".

Keep the concrete action list but pair it with the when-to-use phrasing so both "what" and "when" are explicit.

DimensionReasoningScore

Specificity

Lists multiple concrete actions — "handling API keys and credentials safely, verifying their presence, and prompting the user to add them if missing" — matching the multi-action anchor rather than the domain-only anchor 2.

3 / 3

Completeness

The "what" is clearly stated, but there is no explicit "Use when..." trigger clause, which per the guidelines caps completeness at 2 rather than 3.

2 / 3

Trigger Term Quality

"API keys" and "credentials" are natural terms, but coverage is thin with no common variations (secrets, tokens, .env) and no explicit "Use when" phrasing, so it stops at anchor 2.

2 / 3

Distinctiveness Conflict Risk

It carves a clear niche as a safe credential-handling protocol with distinct triggers and third-person voice, making overlap with other skills unlikely.

3 / 3

Total

10

/

12

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
google-deepmind/science-skills
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.