CtrlK
BlogDocsLog inGet started
Tessl Logo

plugin-auditor

Audit automatically audits AI assistant code plugins for security vulnerabilities, best practices, AI assistant.md compliance, and quality standards when user mentions audit plugin, security review, or best practices check. specific to AI assistant-code-plugins repositor... Use when assessing security or running audits. Trigger with phrases like 'security scan', 'audit', or 'vulnerability'.

59

Quality

70%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

High

Do not use without reviewing

Fix and improve this skill with Tessl

tessl review fix ./plugins/examples/jeremy-plugin-tool/skills/plugin-auditor/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

57%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is well-structured with good progressive disclosure into real reference files, but it leans on repetition and keeps the actual executable scan commands out of the main flow. Adding inline validation checkpoints and consolidating the repeated category lists would lift the weaker dimensions.

Suggestions

Collapse the repeated eight-category descriptions: state them once in Instructions and reference that list from Overview/Output/Examples instead of restating.

Inline one concrete scan command per security check (e.g., the grep for AKIA keys) so the workflow is executable without opening audit-categories.md.

Add an explicit validation checkpoint before report generation (e.g., 'Confirm every category produced a pass/fail result before scoring') to close the workflow-clarity gap.

DimensionReasoningScore

Conciseness

The body is organized and avoids explaining basics Claude already knows, but the eight audit categories are restated across Overview, Instructions, Output, and Examples, and the Resources list duplicates paths already cited inline, so it could be tightened.

2 / 3

Actionability

It cites concrete specifics (AKIA... keys, rm -rf /, eval(), allowed plugin.json fields, `jq empty`, `pnpm run sync-marketplace`), but the actual executable scan commands are deferred to references rather than given inline, leaving key details one hop away.

2 / 3

Workflow Clarity

The eight numbered steps give a clear sequence with step-1 path confirmation and an error-handling table, but there are no explicit validation checkpoints between audit steps (e.g., verify scan results before scoring).

2 / 3

Progressive Disclosure

SKILL.md is a concise overview that points to real, one-level-deep reference files (audit-categories.md, audit-process.md, audit-report-format.md, examples.md, errors.md), each clearly signaled with its purpose in the Resources section.

3 / 3

Total

9

/

12

Passed

Description

82%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description covers what, when, and natural triggers well, but is undermined by garbled, truncated phrasing ('AI assistant.md compliance', 'repositor...', 'Audit automatically audits') that hurts clarity and distinctiveness. It is functional but reads as a draft needing cleanup.

Suggestions

Fix the corrupted text: replace 'AI assistant.md compliance' with the intended reference (likely 'CLAUDE.md compliance') and complete 'repositor...' to 'repositories'.

Remove the redundant 'Audit automatically audits' opener so the verb phrase reads cleanly in third person.

Sharpen distinctiveness by stating the plugin scope upfront (e.g., 'Audits Claude Code plugins...') so generic 'audit'/'security scan' triggers are clearly bounded to plugin review.

DimensionReasoningScore

Specificity

The description enumerates concrete actions ('security vulnerabilities, best practices, AI assistant.md compliance, and quality standards'), but the text is garbled ('Audit automatically audits', 'AI assistant.md compliance', 'repositor...'), so it names the domain and several actions without being clean or comprehensive.

2 / 3

Completeness

It answers both 'what' (audits code plugins for security/best-practices/compliance/quality) and 'when' with an explicit 'Use when assessing security or running audits' clause plus trigger phrases.

3 / 3

Trigger Term Quality

It surfaces natural trigger phrasing a user would actually say — 'audit plugin, security review, or best practices check' and 'security scan', 'audit', or 'vulnerability' — giving good coverage of common variations.

3 / 3

Distinctiveness Conflict Risk

Plugin auditing is a real niche, but the bound ('specific to AI assistant-code-plugins repositor...') is truncated and the trigger terms 'audit'/'security scan' are generic enough to overlap with general security-review skills.

2 / 3

Total

10

/

12

Passed

Validation

87%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation14 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

allowed_tools_field

'allowed-tools' contains unusual tool name(s)

Warning

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

14

/

16

Passed

Repository
jeremylongshore/claude-code-plugins-plus-skills
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.