ark-vulnerability-fixer
CVE research and security patch workflow for Ark. Provides CVE API integration, mitigation strategies, and security-focused PR templates. Works with research, analysis, and setup skills for comprehensive vulnerability fixing.
67
50%
Does it follow best practices?
Impact
95%
2.06xAverage score across 3 eval scenarios
Advisory
Suggest reviewing before use
Optimize this skill with Tessl
npx tessl skill review --optimize ./.claude/skills/vulnerability-fixer/SKILL.mdQuality
Discovery
50%Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.
The description identifies a clear domain (CVE/security patching for Ark) and mentions several capabilities, but lacks an explicit 'Use when...' clause which limits Claude's ability to know when to select it. The trigger terms are reasonable but could be more comprehensive, and the reference to companion skills ('research, analysis, and setup skills') adds ambiguity rather than clarity.
Suggestions
Add an explicit 'Use when...' clause with trigger scenarios, e.g., 'Use when the user asks about CVE lookup, security vulnerabilities, patching known exploits, or creating security-focused pull requests for Ark.'
Include more natural trigger term variations such as 'CVE-XXXX', 'NVD', 'security fix', 'vulnerability remediation', 'security advisory', or 'exploit patch'.
Replace the vague 'Works with research, analysis, and setup skills' with concrete actions like 'queries CVE databases via API, recommends mitigation steps, and generates security-focused PR descriptions with remediation details'.
| Dimension | Reasoning | Score |
|---|---|---|
Specificity | Names the domain (CVE research, security patches) and some actions (API integration, mitigation strategies, PR templates), but the actions are somewhat high-level rather than listing multiple concrete specific operations like 'query CVE databases, generate patch diffs, create security advisories'. | 2 / 3 |
Completeness | The 'what' is partially covered (CVE API integration, mitigation strategies, PR templates), but there is no explicit 'Use when...' clause or equivalent trigger guidance telling Claude when to select this skill. The 'when' is only implied. | 2 / 3 |
Trigger Term Quality | Includes relevant terms like 'CVE', 'security patch', 'vulnerability', 'mitigation', and 'PR templates', but misses common user variations like 'security fix', 'CVE-XXXX-XXXXX', 'vulnerability scan', 'NVD', or 'security advisory'. The term 'Ark' is project-specific and helpful for disambiguation but not a natural trigger. | 2 / 3 |
Distinctiveness Conflict Risk | The mention of 'Ark' and 'CVE' provides some specificity, but the description also references working with 'research, analysis, and setup skills' which is vague and could overlap with other security-related or general workflow skills. The niche is somewhat clear but not sharply defined. | 2 / 3 |
Total | 8 / 12 Passed |
Implementation
50%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The skill is highly actionable with executable commands and clear templates, but suffers significantly from verbosity — templates, cross-skill references, and context explanations are repeated multiple times. The workflow has a good user-approval checkpoint but lacks explicit error recovery loops after fix implementation. Content organization would benefit greatly from splitting templates into separate referenced files.
Suggestions
Extract the PR template, commit message template, and mitigation presentation template into separate referenced files (e.g., TEMPLATES.md) to reduce the main skill from ~300 lines to under 100.
Consolidate the skill composition/cross-reference information into a single section instead of repeating it in the intro, throughout the body, and again in Important Notes.
Add explicit error recovery steps after fix implementation — e.g., 'If make test fails: review error output, check for breaking API changes in the dependency changelog, revert with go get package@old-version if needed.'
Remove explanatory text that Claude already knows (e.g., what CVSS scores are, what the CIRCL API returns, what npm audit does) and keep only the specific commands and Ark-specific context.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The skill is extremely verbose at ~300 lines. It includes extensive template boilerplate (PR templates, commit messages, mitigation presentation templates) that could be referenced externally. It repeatedly explains skill composition and cross-references to other skills (research, analysis, setup) multiple times throughout. The 'Important Notes' section largely restates information already covered above. | 1 / 3 |
Actionability | The skill provides fully executable bash commands throughout — curl for CVE API, grep/find for dependency analysis, git commands for branching, go/npm/pip commands for updates, gh pr create for PR submission. All code blocks are copy-paste ready with clear placeholders. | 3 / 3 |
Workflow Clarity | The overall workflow is outlined in the intro (research → analysis → mitigation → implementation → testing → PR), and there's a clear 'STOP AND WAIT' checkpoint before implementation. However, there are no explicit validation checkpoints after applying fixes beyond basic 'make test/build'. The verification section lacks feedback loops — no 'if tests fail, do X' guidance for error recovery after applying dependency updates. | 2 / 3 |
Progressive Disclosure | The skill references companion skills (research, analysis, setup) but all content is inline in one monolithic file. The lengthy PR template, commit message template, and mitigation presentation template could easily be split into referenced files. The skill composition section is repeated in both the intro and the Important Notes section. | 2 / 3 |
Total | 8 / 12 Passed |
Validation
100%Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.
Validation — 11 / 11 Passed
Validation for skill structure
No warnings or errors.
- Repository
- mckinsey/agents-at-scale-ark
- Commit
f4bfd2d
- Reviewed
Table of Contents
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.