ark-pentest-issue-resolver

Resolve common penetration testing issues in Ark. Use when fixing security vulnerabilities from pentest reports, security audits, or OWASP Top 10 issues.

1.04x

Quality

64%

Does it follow best practices?

Impact

96%

1.04x

Average score across 3 eval scenarios

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./.claude/skills/pentest-issue-resolver/SKILL.md

Quality

Content

60%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable with strong executable examples and a reasonable workflow, but it is excessively verbose for a skill body and fails to use progressive disclosure by inlining ~1000 lines of reference material that belongs in separate files.

Suggestions

Move per-vulnerability detection/mitigation detail into separate reference files (e.g. references/sql-injection.md) and keep SKILL.md as a concise overview with signaled links.

Cut the "Description" explanations of well-known vulnerability classes (what XSS/CSRF/XXE are) since Claude already knows them; keep only Ark-specific detection and fix guidance.

Make the fix-validation loop explicit in the workflow (run tests -> if failing, fix -> re-test) rather than relying on a single "Test the Fixes" step.

Dimension	Reasoning	Score
Conciseness	The ~1000-line body explains vulnerability categories (XSS, CSRF, deserialization, etc.) that Claude already knows, with padded "Description" lines like "Attacker can inject malicious SQL queries through user input" that add little actionable value.	2 / 5
Actionability	Provides copy-paste-ready detection grep patterns and executable mitigation code (parameterized queries, DOMPurify, gorilla/csrf, defusedxml) covering the common cases across Python, Go, and JavaScript.	5 / 5
Workflow Clarity	The 7-step workflow is clearly sequenced with an approval checkpoint before implementing, a test step, and a manual security checklist; minor gaps are the somewhat implicit "verify fix" loop rather than an explicit validate-retry cycle.	4 / 5
Progressive Disclosure	No bundle files exist and the entire reference is a monolithic inline document; per-vulnerability detail that would clearly belong in separate reference files is all inlined with no signaled navigation.	2 / 5
	Total	13 / 20 Passed

Description

70%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description clearly answers both what and when with a well-scoped niche and reasonable trigger terms. It would benefit from naming more concrete vulnerability types directly in the description rather than relying on the generic "resolve issues" framing.

Suggestions

Replace the generic verb "Resolve" with concrete actions, e.g. "Detect, mitigate, and fix penetration testing findings".

Add common trigger keywords users say ("XSS", "SQL injection", "CSRF", "pentest finding") to broaden natural-language matching.

Dimension	Reasoning	Score
Specificity	Phrases like "Resolve common penetration testing issues" name the domain and a couple of concrete actions, but the verbs stay generic ("resolve", "fix") without listing specific capabilities.	3 / 5
Completeness	Explicitly states what ("Resolve common penetration testing issues in Ark") and when ("Use when fixing security vulnerabilities from pentest reports, security audits, or OWASP Top 10 issues"), though the "when" could be slightly more specific.	4 / 5
Trigger Term Quality	Includes natural trigger terms like "pentest reports", "security audits", and "OWASP Top 10 issues"; missing some common variations users would say (e.g. "XSS", "SQL injection", specific CVE language).	4 / 5
Distinctiveness Conflict Risk	Scoped to Ark and the no-CVE pentest niche, making it mostly distinct from other skills with only minor overlap risk against general security-patching skills.	4 / 5
	Total	15 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (1013 lines); consider splitting into references/ and linking	Warning

	Total	15 / 16 Passed

Repository: mckinsey/agents-at-scale-ark
Path: .claude/skills/pentest-issue-resolver/SKILL.md
Commit: 26d4d0b

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.