ark-vulnerability-fixer

CVE research and security patch workflow for Ark. Provides CVE API integration, mitigation strategies, and security-focused PR templates. Works with research, analysis, and setup skills for comprehensive vulnerability fixing.

1.01x

Quality

73%

Does it follow best practices?

Impact

79%

1.01x

Average score across 3 eval scenarios

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./.claude/skills/vulnerability-fixer/SKILL.md

Quality

Content

77%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with executable commands and templates and a clearly sequenced, validated workflow. Its weaknesses are repetition between sections and lack of external file references that would split out the long templates.

Suggestions

Move the commit-message and PR templates into a referenced file (e.g., references/pr-templates.md) and keep a short pointer in SKILL.md to reduce token weight.

Remove the redundant 'Common Vulnerability Types' section or consolidate it with 'Dependency Analysis' and 'Implementation' to avoid repeating the same Go/Node/Python/Docker guidance.

De-duplicate the workflow examples that appear in both 'When to use this skill' and 'Skill Composition'.

Dimension	Reasoning	Score
Conciseness	Mostly efficient with executable commands and templates, but the 'Common Vulnerability Types' section restates Go/Node/Python/Docker guidance already covered in earlier sections, and the workflow/skill-composition lists are repeated, adding noticeable padding.	3 / 5
Actionability	Provides copy-paste-ready curl, git, go, npm, and gh commands along with complete commit-message and PR templates that cover the common cases end to end.	5 / 5
Workflow Clarity	Sequences a multi-step process (research, analysis, mitigation, clone, implement, test, PR) with explicit validation checkpoints including 'STOP AND WAIT' for approval and make test/make build verification, matching the anchor for clear sequence with feedback loops.	5 / 5
Progressive Disclosure	No bundle files exist; everything lives in a single well-sectioned SKILL.md, but large reusable blocks (PR/commit templates, the vulnerability-type reference) are inlined rather than split into referenced files, so structure is present but content that should be separate is inline.	3 / 5
	Total	16 / 20 Passed

Description

70%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and well-differentiated, clearly conveying the CVE research and security patch workflow scope. Its main weakness is the absence of an explicit 'Use when...' trigger clause, which caps completeness.

Suggestions

Add an explicit trigger clause, e.g., 'Use when a user mentions a CVE number or reports a security vulnerability that needs patching in Ark.'

Include a few more natural synonyms ('exploit', 'security advisory', 'CVE number') to broaden trigger term coverage.

Consider naming the supported ecosystems (Go, Node.js, Python, Docker) to sharpen specificity.

Dimension	Reasoning	Score
Specificity	Lists several concrete actions ('CVE API integration, mitigation strategies, and security-focused PR templates') with only minor gaps in coverage, matching the 'several specific actions' anchor rather than the more comprehensive level 5.	4 / 5
Completeness	Gives a clear 'what' (CVE research and security patch workflow) but lacks any explicit 'Use when...' trigger clause; per the rubric a missing explicit trigger clause caps completeness at 3.	3 / 5
Trigger Term Quality	Includes natural terms users would say ('CVE', 'security patch', 'vulnerability') with good coverage, but misses common synonyms like 'exploit' or 'CVE number', fitting 'good keyword coverage; a few natural terms missing' rather than level 5's exhaustive list.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (CVE-specific patch workflow for Ark) with distinct, specialized triggers and minimal overlap risk with other skills.	5 / 5
	Total	16 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
relative_links	Relative link issues: 1 missing	Warning

	Total	15 / 16 Passed

Repository: mckinsey/agents-at-scale-ark
Path: .claude/skills/vulnerability-fixer/SKILL.md
Commit: 26d4d0b

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.