snyk-security

Runs Snyk CLI security scans and fixes the vulnerabilities found. Covers four domains: source code (SAST via snyk code test), open-source dependencies (SCA via snyk test), container images (snyk container test), and infrastructure-as-code files such as Terraform, Kubernetes YAML, and CloudFormation (snyk iac test). Use this skill whenever the user wants to scan for vulnerabilities, audit dependencies, secure a Dockerfile or container image, check IaC for misconfigurations, or asks "is my code/app/image/infra secure?". Also trigger for requests like "fix security issues", "run a security scan", "check for CVEs", "find hardcoded secrets", or "review my Terraform for security problems" even if Snyk is not mentioned by name.

Quality

100%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

100%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a well-structured, actionable guide: it leads with a verification loop, gives executable commands and expected output for each domain, and pushes detail into four real one-level-deep reference files. Validation checkpoints and feedback loops are explicit throughout.

Dimension	Reasoning	Score
Conciseness	Lean and efficient — assumes Claude's competence without explaining what Snyk, CLI, or CVEs are. Each block ('Expected output', 'Done when') earns its place by guiding Claude on what to inspect and when to stop, rather than padding with concept explanations.	5 / 5
Actionability	Fully executable, copy-paste-ready commands throughout — 'snyk code test', 'snyk container test IMAGE:TAG --file=Dockerfile', 'docker build -t IMAGE:NEW-TAG .' — with concrete examples covering all four domains plus troubleshooting commands. No pseudocode.	5 / 5
Workflow Clarity	Explicit core loop 'scan → analyze → fix → verify → repeat until clean' with per-use-case 'Done when' validation checkpoints and re-run-to-confirm feedback loops. Validation is present for batch/remediation operations, satisfying the destructive-ops cap exception.	5 / 5
Progressive Disclosure	Clear overview in SKILL.md with one-level-deep, well-signaled references — each use case links to a real file (references/code-security.md, dependency-security.md, container-security.md, iac-security.md), all of which exist. Navigation is easy and content is appropriately split.	5 / 5
	Total	20 / 20 Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is exemplary: it names concrete capabilities with specific CLI commands, provides rich natural trigger phrases covering synonyms and indirect mentions, and explicitly answers both what the skill does and when to invoke it. It occupies a distinct niche with negligible conflict risk.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions across four domains with explicit CLI commands — 'Runs Snyk CLI security scans and fixes the vulnerabilities found' anchored by 'snyk code test', 'snyk test', 'snyk container test', and 'snyk iac test'. Comprehensive coverage with no vague abstraction.	5 / 5
Completeness	Explicitly answers both 'what' (scan and fix vulnerabilities across source, dependencies, containers, IaC) and 'when' ('Use this skill whenever… Also trigger for requests like…'). Concrete trigger phrases accompany the capability description.	5 / 5
Trigger Term Quality	Comprehensive natural trigger phrases users would actually say — 'is my code/app/image/infra secure?', 'fix security issues', 'run a security scan', 'check for CVEs', 'find hardcoded secrets', 'review my Terraform for security problems'. Covers synonyms and varied phrasings.	5 / 5
Distinctiveness Conflict Risk	Clear niche — Snyk-based security scanning across four named domains with distinct, Snyk-specific triggers and tool references. Minimal overlap risk with unrelated skills.	5 / 5
	Total	20 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: lirantal/snyk-security-skill
Path: skills/snyk-security/SKILL.md
Commit: 804b1e6

Reviewed: 4 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.