CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

qa-static-scan

Search served JavaScript, templates, CSS, and source code for known bug classes (unchecked fetch responses, innerHTML with user data, removed focus outlines, unvalidated redirects, swallowed errors, secrets) and turn every hit into a targeted live test. Use early in any test run or code review.

71

Quality

89%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

88%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A tight, well-structured instruction skill: lean token usage, an explicit hit-to-live-case verification loop, and a clear exit gate. The two weaknesses are minor: one pattern entry is descriptive rather than a literal regex, and two references (tester-static-rules.json, 'the matrix') resolve outside the skill's bundle.

Suggestions

Rewrite the fetch row as a literal, copy-paste-ready regex like the other rows (e.g. 'fetch\([^)]*\)\s*;?(?![\s\S]{0,200}\.ok)' or a grep command) so every pattern entry is executable as written.

The referenced 'tools/harness/tester-static-rules.json' is not part of this skill's bundle — either ship it in a references/ directory or state where it lives so the path is resolvable; do the same for 'the matrix' (name the file or sibling skill that defines it).

DimensionReasoningScore

Conciseness

The ~30-line body is lean and dense — a compact pattern table, one-line procedure steps, and an exit-criteria gate — with no explanation of concepts Claude already knows; every token earns its place, matching the top anchor.

5 / 5

Actionability

Mostly executable guidance: literal regexes like 'innerHTML\s*=', 'catch\s*\(\w*\)\s*\{\s*\}', 'outline:\s*none', and 'sk_live_' plus a concrete fetch-run-record procedure. Minor gaps keep it below 5: the fetch row ('await fetch( with no .ok / status nearby before navigation') is descriptive rather than a literal regex, and 'write a live case ID in the matrix' references a matrix not defined in this skill.

4 / 5

Workflow Clarity

A clear 3-step sequence (fetch served code, run patterns and record locations, convert each hit to a live case) with explicit validation via the exit criteria — 'Every hit is either converted into a live case or dismissed with a written reason' — and a built-in verification loop ('Each one must become a live case before it can be called a bug'). The scan is read-only, so the destructive/batch cap does not apply.

5 / 5

Progressive Disclosure

Sections are well organized for a sub-50-line skill, but the 'Learned rules' section points to 'tools/harness/tester-static-rules.json', which does not exist in this skill's bundle (no references/ or scripts/ directory is present), and 'the matrix' similarly points outside the skill — 'references mostly clear; minor organization gaps' rather than fully navigable.

4 / 5

Total

18

/

20

Passed

Description

85%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description: highly specific capabilities with an explicit when-to-use clause and concrete trigger contexts. Its main weakness is trigger breadth — 'any test run or code review' invites overlap with adjacent skills and misses natural synonyms like 'QA' or 'audit'.

Suggestions

Narrow the trigger clause from 'any test run or code review' to specific contexts, e.g. 'Use when QA-testing or reviewing a deployed web app's served code', to reduce overlap with general code-review and test-writing skills.

Add natural synonym triggers users would actually say — 'QA', 'audit', 'bug hunt', 'find bugs in the deployed site' — to improve trigger term coverage.

Keep the enumerated bug-class list; it is the strongest part of the description and worth preserving verbatim.

DimensionReasoningScore

Specificity

The description lists multiple concrete actions — 'Search served JavaScript, templates, CSS, and source code for known bug classes (unchecked fetch responses, innerHTML with user data, removed focus outlines, unvalidated redirects, swallowed errors, secrets) and turn every hit into a targeted live test' — with comprehensive, enumerated coverage matching the top anchor.

5 / 5

Completeness

Both what ('Search... for known bug classes... and turn every hit into a targeted live test') and when ('Use early in any test run or code review') are explicitly and concretely answered, with a clear trigger clause; the when is explicit rather than weakly implied, matching the top anchor.

5 / 5

Trigger Term Quality

Natural terms like 'test run', 'code review', 'JavaScript', 'CSS', 'bug', and 'secrets' give good keyword coverage, but common variations users would actually say — 'QA', 'audit', 'find bugs', 'security scan' — are missing, matching the 'good coverage; a few natural terms missing' anchor rather than comprehensive synonym coverage.

4 / 5

Distinctiveness Conflict Risk

The static-scan-to-live-test niche is fairly specific, but the trigger 'Use early in any test run or code review' is broad enough that general code-review, test-writing, and security-audit skills would also fire on it, matching 'somewhat specific but could still overlap with similar skills' rather than 'minor overlap risk with closely related skills'.

3 / 5

Total

17

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

itsablabla/qa-bug-agent-skills

Path

skills/qa-static-scan/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.