scanning-container-security

Execute use when you need to work with security and compliance. This skill provides security scanning and vulnerability detection with comprehensive guidance and automation. Trigger with phrases like "scan for vulnerabilities", "implement security controls", or "audit security".

Quality

65%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./plugins/devops/container-security-scanner/skills/scanning-container-security/SKILL.md

Quality

Content

80%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is concise and highly actionable with concrete scanner commands and a thorough error-handling table, but the workflow lacks explicit validation checkpoints and it fails to surface the bundled helper scripts that could offload detail. Adding checkpoint steps and references to the existing scripts would round it out.

Suggestions

Insert explicit validation checkpoints into the workflow, e.g. after scanning: 'Review findings for Critical/High CVEs; if scan failed or timed out, apply the matching fix from the error table and re-run before proceeding.'

Reference the bundled scripts where relevant (e.g. 'For automated runs, see [scripts/trivy_scan.py](scripts/trivy_scan.py) and [scripts/snyk_scan.py](scripts/snyk_scan.py)') so the existing bundle is discoverable instead of orphaned.

Add a brief 'Verify' step that confirms the scan completed and the report was generated in the requested format (JSON/SARIF) before moving to remediation.

Dimension	Reasoning	Score
Conciseness	The body is lean and efficient, assumes Claude's competence, and avoids explaining concepts Claude already knows (no 'what is a container' padding); every section earns its place, matching anchor 3.	3 / 3
Actionability	It provides concrete, executable commands with copy-paste-ready placeholders (`trivy image <image:tag>`, `hadolint Dockerfile`, `--scanners secret`, `--timeout 15m`) plus a specific error-cause-solution table and SARIF output guidance, matching anchor 3.	3 / 3
Workflow Clarity	The nine numbered steps form a clear sequence, but there are no explicit validation checkpoints or validate→fix→retry feedback loops woven into the flow; the error table is reference material rather than an inline checkpoint, landing at anchor 2.	2 / 3
Progressive Disclosure	Sections are well organized, but bundled scripts (`scripts/trivy_scan.py`, `scripts/snyk_scan.py`) exist and are never signaled from the body, and the scan guidance is fully inline instead of pointing to those scripts, matching anchor 2's 'references present but not clearly signaled.'	2 / 3
	Total	10 / 12 Passed

Description

50%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description provides explicit trigger guidance and a recognizable security-scanning niche, but it is generic, fluff-laden, and omits the container/image specificity that would distinguish this skill. Tightening the 'what' and adding container-focused trigger terms would materially improve it.

Suggestions

Replace 'with comprehensive guidance and automation' with concrete container-scanning actions, e.g. 'Scan container images and Dockerfiles for vulnerabilities, misconfigurations, and secrets using Trivy, Grype, and Hadolint.'

Add natural container-specific trigger terms users would actually say, such as 'scan Docker image', 'container vulnerability', 'CVE in base image', or 'Trivy scan'.

Fix the malformed opener 'Execute use when' to a clean 'Use when…' clause and reframe 'security and compliance' around containers/images to reduce overlap with generic security skills.

Dimension	Reasoning	Score
Specificity	It names the domain and a couple of actions ('security scanning and vulnerability detection') but pads with fluff ('comprehensive guidance and automation') and never names the concrete container/image targets that anchor 3 requires.	2 / 3
Completeness	Explicit 'when' guidance is present ('Trigger with phrases like…'), but the 'what' is generic and over-claimed rather than clearly stating the container-scanning capability, so it does not cleanly reach the anchor-3 bar of clearly answering both.	2 / 3
Trigger Term Quality	Three trigger phrases ('scan for vulnerabilities', 'implement security controls', 'audit security') are relevant, but common container-specific variations a user would say (Docker, image, CVE, trivy) are missing, matching anchor 2.	2 / 3
Distinctiveness Conflict Risk	The broad framing 'security and compliance' with generic trigger phrases would overlap many security skills, and the description never mentions containers, Docker, or images, keeping it at anchor 2 rather than a distinct niche.	2 / 3
	Total	8 / 12 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
allowed_tools_field	'allowed-tools' contains unusual tool name(s)	Warning
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	14 / 16 Passed

Repository: jeremylongshore/claude-code-plugins-plus-skills
Path: plugins/devops/container-security-scanner/skills/scanning-container-security/SKILL.md
Commit: c4eafaf

Reviewed: 5 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.