CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

42crunch

42Crunch integration. Manage data, records, and automate workflows. Use when the user wants to interact with 42Crunch data.

Quality

65%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/42crunch/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

67%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body delivers a strong, executable operational workflow: setup, connection lifecycle with explicit state handling, action discovery/execution, and a proxy fallback, all with concrete commands and a feedback loop for connection readiness. Weaknesses are moderate verbosity in the overview and intro sections, a duplicated discovery command, a broken "Step 2" cross-reference, and a "Popular actions" section that lists no actual actions.

Suggestions

Trim the marketing-style intro and the vague "When to use which actions" and agent-types sentences, and deduplicate the action-list command (shown in both "Searching for actions" and "Popular actions").

Fix the "skip to **Step 2**" cross-reference by labeling the action-discovery section as Step 2 (and the connection section as Step 1) so the "1b" subsection numbering is coherent.

Populate "Popular actions" with one or two concrete 42Crunch examples (e.g., running a Security Audit on an API version) so the most common use case has a worked, copy-paste-ready invocation.

DimensionReasoningScore

Conciseness

The body is mostly efficient, command-driven content, but contains unnecessary padding: the marketing-style intro ("It's used by developers and security teams to identify vulnerabilities... early in the development lifecycle"), the vague "When to use which actions" paragraph, the fuzzy agent-types sentence, and the action-list command demonstrated twice ("Searching for actions" and "Popular actions"). Matches anchor 3 (mostly efficient with some unnecessary explanation) rather than 4 because several sections could be trimmed or cut.

3 / 5

Actionability

Concrete, copy-paste-ready CLI commands throughout: install, login with headless completion, connection ensure, polling with --wait, action run with --input JSON, and a proxy request table with flags. Not score 5 because the "Popular actions" section contains no actual 42Crunch action example (e.g., invoking a security audit), leaving the most common use case unexemplified.

4 / 5

Workflow Clarity

Clear sequence (install → login → connection ensure → poll states → discover actions → run → proxy fallback) with state-based feedback loops (CLIENT_ACTION_REQUIRED handling, re-poll until READY, error field on failure). Minor gaps: the "skip to **Step 2**" pointer references a section that is never labeled as Step 2, and the "1b" subsection has no matching numbered steps.

4 / 5

Progressive Disclosure

No bundle files exist; the single ~145-line body is well-organized with clear headers, nothing buried, and no nested references. Good structure matches anchor 4; not score 5 because some inline content (the detailed clientAction state reference and the proxy options table) could reasonably live in a separate reference file.

4 / 5

Total

15

/

20

Passed

Description

48%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description has an explicit "Use when..." trigger and a distinctive niche name, but the capability statement is generic filler that fails to convey what 42Crunch actually does (API security auditing and testing). Trigger coverage is limited to the brand name, missing the natural language a user would use when needing API security work.

Suggestions

Replace "Manage data, records, and automate workflows" with the platform's concrete capabilities, e.g. "Run API security audits, configure API firewall protection, and validate API contracts against their definitions.

Extend the trigger clause with natural user phrasings: "Use when the user mentions 42Crunch, API security auditing, scanning API definitions for vulnerabilities, or API firewall configuration."

Ground the description in the domain vocabulary already present in the body (API Inventory, Security Audit, Contract Validation) so it distinguishes this skill from generic data-management integrations.

DimensionReasoningScore

Specificity

"Manage data, records, and automate workflows" names the 42Crunch domain but the actions are generic; the platform's actual capabilities (API security auditing, API firewall, contract validation) are never mentioned. Not score 3 because no concrete domain-specific action is listed; not score 1 because the domain is at least clearly named.

2 / 5

Completeness

An explicit "Use when the user wants to interact with 42Crunch data" clause is present, but the "what" ("Manage data, records, and automate workflows") is too generic to convey what the skill concretely does. Below anchor 4, which expects a solid "what" paired with the "when"; above anchor 3's typical failure mode only in that the "when" is explicit.

3 / 5

Trigger Term Quality

"42Crunch" and "interact with 42Crunch data" are relevant keywords a user might say, but the natural phrases for this domain (API security, audit my API, API firewall, OpenAPI) are all missing. Matches anchor 3 (some relevant keywords, missing common variations) rather than 4 because coverage of natural terms is thin.

3 / 5

Distinctiveness Conflict Risk

"42Crunch integration" carves out a clear niche with a distinct trigger term and minimal conflict risk. Not score 5 because the generic middle phrase ("Manage data, records, and automate workflows") adds minor overlap risk with broad data-management skills.

4 / 5

Total

12

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository

membranedev/application-skills

Path

skills/42crunch/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.