CtrlK
BlogDocsLog inGet started
Tessl Logo

plugin-installer

Install validated Codex plugins from trusted sources with quarantine validation, provenance, and rollback. Use when distribution and installation are the primary goals.

44

Quality

44%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

The risk profile of this skill

Fix and improve this skill with Tessl

tessl review fix ./Plugins/plugin-factory/skills/infrastructure_ops/plugin-installer/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

22%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

This skill reads more like an abstract design document than an actionable instruction set. It establishes good conceptual boundaries (ownership, anti-patterns, failure modes, constraints) but fails to provide any concrete, executable guidance — no code snippets, no specific commands for install/quarantine/rollback, and no inline workflow steps. The heavy delegation to external references without a meaningful inline summary leaves the skill body insufficient for Claude to act on independently.

Suggestions

Add a concrete, step-by-step inline workflow showing the actual install sequence (e.g., 1. Clone from pinned ref, 2. Run quarantine validation, 3. Check provenance artifact, 4. Install to destination, 5. Verify visibility) with executable commands or code at each step.

Include at least one complete worked example showing input parameters, the commands/code executed, and the expected output JSON structure — the output schema is described but never shown.

Replace abstract phrases like 'Use the staged install protocol' and 'Apply the context-disposition policy' with the actual concrete actions Claude should take, or at minimum provide a brief inline summary of what those protocols entail.

Add explicit validation checkpoints within the workflow (e.g., 'If provenance check fails, STOP and report: {blocker_template}') rather than just listing failure conditions separately.

DimensionReasoningScore

Conciseness

The skill is moderately efficient but includes some unnecessary abstraction and jargon (e.g., 'context-disposition policy', 'OpenAI-style plugin design contract', 'stronger side-effect classes') that add cognitive load without clear payoff. Some sections like 'Philosophy' are too terse to be useful, while others like 'Execution Boundaries' are verbose without being concrete.

2 / 3

Actionability

The skill lacks any concrete, executable code, commands, or specific examples. It describes concepts abstractly ('Use the staged install protocol', 'Apply the context-disposition policy') without showing what an actual install command, validation check, or rollback operation looks like. The examples section contains only natural language prompts, not executable workflows or code.

1 / 3

Workflow Clarity

The workflow is entirely delegated to 'references/workflow.md' with no inline summary of the actual steps. For a skill involving destructive/write operations (installation, rollback), there are no explicit sequenced steps or validation checkpoints visible in the skill body itself. The validation section shows a bash command but doesn't integrate it into a step-by-step flow.

1 / 3

Progressive Disclosure

The skill does reference external files (workflow.md, contract.yaml, evals.yaml, etc.) with clear 'Read when' guidance, which is good structure. However, no bundle files were provided to verify these references exist, and the skill body itself is too thin — it delegates almost everything to references without providing enough inline content to be useful on its own.

2 / 3

Total

6

/

12

Passed

Description

67%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description adequately covers both what the skill does and when to use it, earning full marks on completeness. However, it relies on somewhat technical jargon that users may not naturally use, and the specific capabilities could be more concretely enumerated. The distinctiveness is moderate — it carves out a niche around Codex plugin installation but could be more precise in its trigger terms.

Suggestions

Add more natural trigger terms users would actually say, such as 'add plugin', 'plugin setup', 'extension install', 'package management'.

Replace or supplement jargon like 'quarantine validation' and 'provenance' with more concrete actions, e.g., 'verify plugin signatures, sandbox-test before enabling, track plugin source and version history'.

DimensionReasoningScore

Specificity

Names the domain (Codex plugins) and several actions (install, quarantine validation, provenance, rollback), but these are somewhat abstract — 'quarantine validation' and 'provenance' are not concrete user-facing actions. It doesn't list specific step-by-step capabilities like 'verify signatures, check checksums, sandbox test execution.'

2 / 3

Completeness

Clearly answers both 'what' (install validated Codex plugins with quarantine validation, provenance, and rollback) and 'when' ('Use when distribution and installation are the primary goals'). The 'Use when...' clause is present and explicit.

3 / 3

Trigger Term Quality

Includes some relevant terms like 'install', 'plugins', 'rollback', and 'Codex plugins', but uses technical jargon ('quarantine validation', 'provenance') that users are unlikely to naturally say. Missing common variations like 'add plugin', 'plugin setup', 'extension', 'package install'.

2 / 3

Distinctiveness Conflict Risk

The focus on 'Codex plugins' and 'installation' provides some distinctiveness, but the phrase 'distribution and installation' is broad enough to potentially overlap with other plugin management or package installation skills. The 'quarantine validation' and 'provenance' terms help differentiate but are not strongly distinctive triggers.

2 / 3

Total

9

/

12

Passed

Validation

90%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation10 / 11 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

Total

10

/

11

Passed

Repository
jscraik/Agent-Skills
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.