ark-vulnerability-fixer

CVE research and security patch workflow for Ark. Provides CVE API integration, mitigation strategies, and security-focused PR templates. Works with research, analysis, and setup skills for comprehensive vulnerability fixing.

1.01x

Quality

46%

Does it follow best practices?

Impact

79%

1.01x

Average score across 3 eval scenarios

Securityby

Advisory

Suggest reviewing before use

Optimize this skill with Tessl

npx tessl skill review --optimize ./.claude/skills/vulnerability-fixer/SKILL.md

Quality

Discovery

50%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description identifies a clear domain (CVE/security patching for Ark) and mentions several capabilities, but lacks an explicit 'Use when...' clause which limits Claude's ability to know when to select it. The trigger terms are reasonable but could be more comprehensive, and the reference to companion skills adds context but also introduces vagueness.

Suggestions

Add an explicit 'Use when...' clause with trigger scenarios, e.g., 'Use when the user asks about CVE lookup, security vulnerabilities, patching known exploits, or creating security-focused pull requests for Ark.'

Include more natural trigger term variations such as 'CVE-XXXX', 'NVD', 'security advisory', 'vulnerability fix', 'security update', or 'exploit mitigation'.

Make the concrete actions more specific, e.g., 'Queries CVE databases via API, generates mitigation recommendations, and produces security-focused PR descriptions with remediation details.'

Dimension	Reasoning	Score
Specificity	Names the domain (CVE research, security patches) and some actions (API integration, mitigation strategies, PR templates), but the actions are somewhat high-level rather than listing multiple concrete specific operations like 'query CVE databases, generate patch diffs, create security advisories'.	2 / 3
Completeness	The 'what' is partially covered (CVE API integration, mitigation strategies, PR templates), but there is no explicit 'Use when...' clause or equivalent trigger guidance telling Claude when to select this skill. The 'when' is only implied.	2 / 3
Trigger Term Quality	Includes relevant terms like 'CVE', 'security patch', 'vulnerability', 'mitigation', and 'PR templates', but misses common user variations like 'security fix', 'CVE-XXXX-XXXXX', 'vulnerability scan', 'NVD', or 'security advisory'. The term 'Ark' is project-specific and helpful for disambiguation but not a natural trigger.	2 / 3
Distinctiveness Conflict Risk	The mention of 'Ark' and 'CVE' provides some specificity, but the description also references working with 'research, analysis, and setup skills' which is vague and could overlap with other security-related or general workflow skills. The niche is somewhat clear but not sharply defined.	2 / 3
	Total	8 / 12 Passed

Implementation

42%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The skill is highly actionable with executable commands and concrete examples throughout, which is its primary strength. However, it suffers significantly from verbosity and poor progressive disclosure — full PR templates, commit templates, and mitigation presentation templates are all inline rather than referenced from separate files. The workflow has a good user-approval checkpoint but lacks validation feedback loops after applying fixes, which is important for security-critical operations.

Suggestions

Extract the PR template, commit message template, and mitigation presentation template into separate referenced files (e.g., TEMPLATES.md) to dramatically reduce the main skill's token footprint.

Remove redundant skill composition explanations — the workflow is described in 'When to use this skill', repeated in 'Skill Composition' under Important Notes, and referenced throughout individual sections.

Add explicit validation feedback loops after applying fixes: 'If tests fail → check for breaking API changes → consult vendor migration guide → adjust and re-test'.

Move the 'Common Vulnerability Types' section to a separate reference file since it's supplementary detail that doesn't need to be loaded for every invocation.

Dimension	Reasoning	Score
Conciseness	The skill is extremely verbose at ~300+ lines. It includes extensive template boilerplate (PR templates, commit messages, mitigation presentation templates) that could be in separate files. It repeatedly explains skill composition and cross-references to other skills (research, analysis, setup) multiple times. The 'When to use this skill' section, 'Important Notes' section, and 'Skill Composition' section contain significant redundancy.	1 / 3
Actionability	The skill provides fully executable bash commands throughout — curl for CVE API, grep/find for dependency analysis, git commands for branching, go/npm/pip commands for updates, gh pr create for PR submission. Code examples are copy-paste ready with clear placeholders.	3 / 3
Workflow Clarity	The overall workflow is outlined (research → analysis → mitigation → clone → fix → test → PR) and there's a clear 'STOP AND WAIT' checkpoint for user approval. However, there are no explicit validation checkpoints after applying fixes beyond basic 'make test' and 'make build'. The verification section lacks feedback loops — no 'if tests fail, do X' guidance. For a security patching workflow involving potentially breaking changes, this is insufficient.	2 / 3
Progressive Disclosure	This is a monolithic wall of text with everything inline — full PR templates, commit message templates, mitigation presentation templates, and detailed npm override guidance all embedded in the main file. The PR template alone is ~30 lines that should be in a separate file. References to other skills are mentioned but the content that should be split out (templates, common vulnerability type details) remains inline.	1 / 3
	Total	7 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 11 / 11 Passed

Validation for skill structure

No warnings or errors.

Repository: mckinsey/agents-at-scale-ark
Commit: fc5746e

Reviewed: 4 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.