CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

apisecai

Apisec.ai integration. Manage data, records, and automate workflows. Use when the user wants to interact with Apisec.ai data.

Quality

70%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/apisecai/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

71%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is a strong, executable guide: concrete CLI commands cover install, auth, connection lifecycle (including state polling and error handling), action discovery/execution, and a proxy fallback. Main weaknesses are the broken internal step references ("Step 2", "1b"), inconsistent membrane/npx invocation, and a monolithic structure where connection-state details and proxy reference could live in separate files.

Suggestions

Fix the internal navigation: either add explicit numbered steps (1. Connect, 2. Discover actions, 3. Run) so "skip to Step 2" and "1b" resolve, or replace those references with the actual section names.

Standardize CLI invocation (pick `membrane` after install or `npx @membranehq/cli` consistently) across all examples, including the connection get polling commands.

Move the connection clientAction state-machine details and the proxy flags table into a reference file (e.g., references/connection-states.md, references/proxy.md) to shrink the SKILL.md overview.

DimensionReasoningScore

Conciseness

The body is command-dense with little conceptual padding (it explains Membrane, which Claude genuinely doesn't know). Minor trimmable filler remains: "Use action names and parameters as needed." and the rambling Agent Types note. Not 5 because of these small unnecessary passages.

4 / 5

Actionability

Nearly every section gives copy-paste-ready commands (npm install, membrane login, connection ensure, action list/run, request with a full flags table). Not 5 because CLI invocation is inconsistent (bare `membrane` vs `npx @membranehq/cli`) and "skip to Step 2" points at a heading that doesn't exist, leaving minor gaps to resolve before running.

4 / 5

Workflow Clarity

The install → login → connect → search → run sequence is clear, with state-based checkpoints (poll BUILDING, handle CLIENT_ACTION_REQUIRED, check the error field on CONFIGURATION_ERROR/SETUP_FAILED). Not 5 because the step numbering is incoherent — "skip to Step 2" and heading "1b" reference a numbered scheme that isn't in the document — which muddies navigation between phases.

4 / 5

Progressive Disclosure

Sections are well-organized headers, but the ~140-line body is fully monolithic with zero bundle files; content that naturally belongs in references (the connection clientAction state machine, the proxy request flags table) is inlined. Not 4 because there is no offloading at all, and the body exceeds the size where sectioning alone suffices.

3 / 5

Total

15

/

20

Passed

Description

57%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description correctly names the target product and includes an explicit 'Use when' clause, but its capability statements are generic integration boilerplate rather than Apisec-specific actions, and trigger coverage depends entirely on the product name. Users describing the underlying need (API security testing, vulnerability scans) rather than naming Apisec.ai would not find it.

Suggestions

Replace "Manage data, records, and automate workflows" with Apisec-specific capabilities, e.g., "Run API security tests, review test results, and manage API inventory and endpoints".

Expand the 'Use when' clause with natural trigger phrases: "Use when the user mentions Apisec.ai, API security testing, API vulnerabilities, or wants to review API inventory or scan results".

Mention concrete domain objects (security tests, test results, integrations, users) as trigger keywords so the skill fires for users describing the need rather than the product.

DimensionReasoningScore

Specificity

"Manage data, records, and automate workflows" are generic actions that could describe almost any integration; only the domain (Apisec.ai) is named. It is not 3 because no concrete Apisec-specific actions (e.g., run security tests, review API inventory or vulnerabilities) are stated.

2 / 5

Completeness

Both a what ("Manage data, records, and automate workflows") and an explicit when ("Use when the user wants to interact with Apisec.ai data") are present. Not 5 because the when is circular (restates the domain) and the what lacks concrete trigger phrases; not 3 because the when is explicit, not merely implied.

4 / 5

Trigger Term Quality

"Apisec.ai" is a strong, natural trigger term, but common variations users would say — "API security", "API vulnerabilities", "security testing/scanning" — are absent. Not 4 because coverage beyond the product name is essentially nil.

3 / 5

Distinctiveness Conflict Risk

Being anchored to the distinct product name "Apisec.ai" gives it a clear niche with only minor overlap risk against other security/scanning skills. Not 5 because triggers rely solely on the product name with no distinct capability phrases.

4 / 5

Total

13

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository

membranedev/application-skills

Path

skills/apisecai/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.