CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

fix-vulns-git-integration

Automated vulnerability triage and dependency bumps for the git_integration worker (Python via uv + the two vendored Go modules). Fetches open Dependabot alerts scoped to git_integration manifests, correlates them with open Dependabot PRs, classifies each fix as safe or needs-human, validates safe fixes locally on the PR branches merged with latest main (uv sync / lint / pytest + full git-integration image build, which compiles both Go modules), updates safe PR branches server-side so they are one click from merge, then posts a "safe to merge" review summary to Slack and opens PRs for alerts Dependabot has no PR for. NEVER merges PRs, never dismisses alerts, never deploys without explicit user confirmation. Use when the user says "fix vulns", "bump deps", "dependabot triage", or asks about git_integration vulnerabilities.

Quality

91%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Low

Low-risk findings worth noting

SKILL.md
Quality
Evals
Security

Quality

Content

88%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

An exemplary operational runbook: fully executable commands, a clearly phased workflow, and pervasive validation and recovery handling for what is a risky batch operation. The only areas short of top marks are token efficiency — a few justifying asides could be trimmed — and structure, where some dense Phase 3 edge-case detail could be moved to a reference file.

Suggestions

Trim the rationale parentheticals that justify rules (e.g. why a PR-resolved version above the advisory minimum shifts the review window, and the explanation of why per-PR validation misses cross-bump conflicts) down to the operative instruction, keeping the rules themselves.

Move the Phase 3 update-branch edge-case detail (422 semantics, expected-head-sha handling, main-advance revalidation) into a references/ file linked one level deep, keeping the main body to the happy-path command and when to consult the reference.

DimensionReasoningScore

Conciseness

Nearly every sentence carries non-obvious, repo-specific operational knowledge (stale-alert detection, Dependabot branch staleness, 422 semantics on update-branch, why repo CI doesn't gate this worker) rather than concepts Claude already knows, but a few rationale parentheticals — e.g. the combined-merge justification and the main-advance re-fetch explanation — could be trimmed, so it is efficient with minor over-explanation rather than perfectly lean.

4 / 5

Actionability

Guidance is fully executable and copy-paste ready: exact `gh api` commands with jq filters, `uv lock --upgrade-package '<pkg>==<target>'`, the `docker run golang:1.25-alpine` snippet, `docker compose -f ../../../scripts/services/git-integration.yaml build git-integration-dev`, and exact commit-message and PR-title formats covering the common pip/go/direct/transitive cases.

5 / 5

Workflow Clarity

Phases 0–5 are clearly sequenced with explicit validation checkpoints and feedback loops throughout: "re-check the PR is still open and its head is still the revision that was validated", revalidate on head-SHA change or main advance, on failure "revert that package's changes… mark it failed-validation" and "bisect by re-validating PRs individually" — exemplary for a batch workflow.

5 / 5

Progressive Disclosure

As a single-file skill with no bundle, it is well organized into clear sections (Hard rules, Phase 0–5, Final report) with nothing buried, but at ~275 lines the detailed Phase 3 edge-case handling (update-branch 422 semantics, main-advance revalidation) is a candidate for a one-level-deep reference file, so it fits good-structure-with-minor-gaps rather than the simple-skill top anchor.

4 / 5

Total

18

/

20

Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description: third-person, concrete, and comprehensive, covering the full workflow with explicit safety constraints ("NEVER merges PRs, never dismisses alerts") and an explicit 'Use when' trigger clause. The only weakness is that the trigger list omits a few natural synonyms a user might say, such as 'security alerts' or 'CVEs'.

DimensionReasoningScore

Specificity

The description enumerates the entire pipeline as concrete actions — "Fetches open Dependabot alerts scoped to git_integration manifests", "correlates them with open Dependabot PRs", "classifies each fix as safe or needs-human", "validates safe fixes locally", "updates safe PR branches server-side", "posts a 'safe to merge' review summary to Slack and opens PRs" — with no coverage gaps, matching the comprehensive-coverage anchor rather than the minor-gaps anchor.

5 / 5

Completeness

It explicitly answers both questions: the 'what' is the full enumerated triage-and-bump pipeline, and the 'when' is an explicit "Use when the user says 'fix vulns', 'bump deps', 'dependabot triage'…" clause with concrete trigger phrases, exactly matching the top anchor; it is not the level below because the 'when' is fully explicit rather than merely present.

5 / 5

Trigger Term Quality

The triggers "fix vulns", "bump deps", "dependabot triage", and "git_integration vulnerabilities" are natural phrases a user would say, but common variations like "CVEs", "security alerts", or "update dependencies" are missing, so it fits the good-but-not-comprehensive keyword anchor rather than the comprehensive-synonyms anchor.

4 / 5

Distinctiveness Conflict Risk

The skill is scoped to "the git_integration worker (Python via uv + the two vendored Go modules)" with repo- and tool-specific triggers (Dependabot, git_integration), giving it a clear niche with minimal overlap risk against generic dependency or vulnerability skills.

5 / 5

Total

19

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

allowed_tools_field

'allowed-tools' contains unusual tool name(s)

Warning

Total

15

/

16

Passed

Repository

linuxfoundation/crowd.dev

Path

.claude/skills/fix-vulns-git-integration/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.