CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

fix-class-sweep

After fixing one instance, search served code and source for every sibling of the same bug class, including bypass variants, and fix or list each one. Use for every fix of a security, validation, access, idempotency, rendering, or error-handling bug.

68

Quality

86%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

82%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

An exceptionally lean, dense skill whose class table provides directly greppable search strings and concrete bypass payloads, with a clear procedure and explicit exit criteria including a guard-based validation step. The main gaps are the undefined 'shared helper' and unspecified guard command, and the lack of an explicit fix-and-re-run loop.

Suggestions

Identify the 'shared helper' by name and path (or reference where it is defined) so step 2 of the Procedure is executable without guessing.

Make step 3 an explicit feedback loop: if the guard run reports new hits, fix them and re-run until the count is zero.

Give the concrete guard invocation (e.g. the exact command for tools/guards.py and where its ESLint/semgrep port lives) instead of 'tools/guards.py or its ESLint/semgrep port'.

DimensionReasoningScore

Conciseness

The dense per-class table of search strings and bypass payloads ('redirect(', '127.1', '0x7f000001') assumes Claude's competence and explains nothing it already knows; every token earns its place.

5 / 5

Actionability

Concrete greppable search strings and payloads cover the common cases, but 'Fix each with the shared helper' never identifies the helper, and 'tools/guards.py or its ESLint/semgrep port' leaves the actual guard command unspecified.

4 / 5

Workflow Clarity

The three-step Procedure has an explicit validation checkpoint ('Run the Fixer guards ... zero new hits') and defined exit criteria, but the fix-and-re-run feedback loop is only implicit — there is no 'if hits remain, fix and re-run' step for this batch operation.

4 / 5

Progressive Disclosure

At 24 lines with well-organized sections (class table, Procedure, Exit criteria) and no external reference files needed, the structure is good; the dangling pointers to 'the shared helper' and the 'qa-static-scan' counterpart skill are not clearly signaled.

4 / 5

Total

17

/

20

Passed

Description

83%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description that clearly and explicitly states both capability and trigger conditions in third person, with concrete language throughout. Keyword coverage is good though it lacks common synonyms (XSS, IDOR, auth), and the broad when-clause creates some overlap risk with adjacent security/review skills.

DimensionReasoningScore

Specificity

Names several concrete actions ('search served code and source for every sibling of the same bug class, including bypass variants, and fix or list each one'), with a minor gap: the bug classes are only enumerated indirectly via the when-clause domains, and 'served code' is slightly jargon-y.

4 / 5

Completeness

Explicitly answers both what ('search served code and source for every sibling of the same bug class ... and fix or list each one') and when ('Use for every fix of a security, validation, access, idempotency, rendering, or error-handling bug') with concrete trigger phrases.

5 / 5

Trigger Term Quality

'Use for every fix of a security, validation, access, idempotency, rendering, or error-handling bug' covers good natural terms, but misses common variations users would say such as XSS, IDOR, auth, or sanitization.

4 / 5

Distinctiveness Conflict Risk

The sibling-bug-sweep niche is distinct, but the broad 'every fix of a security ... bug' trigger will co-fire with closely related skills like security-review or code review skills.

4 / 5

Total

17

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

itsablabla/qa-bug-agent-skills

Path

skills/fix-class-sweep/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.