Tessl • The management layer for AI agent skills

SkillPublic

bright-security

Bright Security integration. Manage data, records, and automate workflows. Use when the user wants to interact with Bright Security data.

Quality

67%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/bright-security/SKILL.md

Quality

Content

63%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body delivers an actionable, command-first integration guide with a genuinely well-handled connection state machine and validation loops, and the proxy fallback is clearly documented. Main weaknesses are a dangling 'Step 2' reference and empty 'Popular actions' section, some redundant/background material, and no progressive disclosure — all troubleshooting detail is inlined in a single file.

Suggestions

Fix the workflow numbering: either label the steps (Step 1: connect, Step 2: search/run actions) so 'skip to **Step 2**' resolves, or renumber '1b' into a coherent sequence; also populate 'Popular actions' with actual commonly-used Bright actions (e.g. list scans, get issue details) instead of just repeating the discovery command.

Trim the opening product-description paragraph and the duplicated 'action list' command to save tokens, and move the detailed connection-state troubleshooting (clientAction handling) and proxy options table into a references/ file, keeping SKILL.md as a lean overview.

Keep the auth section's headless guidance — it is good — but merge the stray 'Agent Types' paragraph into the login step where it is actually used.

Dimension	Reasoning	Score
Conciseness	Commands and steps are mostly tight, but there is unnecessary material: the opening paragraph explaining what Bright Security is ('Bright Security is a developer-focused security testing tool that integrates into the CI/CD pipeline...'), a duplicated 'action list' command in both 'Searching for actions' and 'Popular actions', and an oddly placed 'Agent Types' paragraph. Fits 'Mostly efficient but includes some unnecessary explanation or could be tightened' — not level 2, since padding is limited rather than pervasive.	3 / 5
Actionability	Concrete, executable commands throughout: 'npm install -g @membranehq/cli@latest', 'membrane connection ensure "https://brightsec.com/" --json', 'membrane action run <actionId> --connectionId=... --input ...', plus a complete proxy options table. Not level 5 because of minor gaps: 'skip to Step 2' references a step that is never labeled, and the 'Popular actions' section contains a header and discovery command but no actual popular actions.	4 / 5
Workflow Clarity	There is a clear sequence (install CLI → login → connection ensure → poll until READY → search actions → run actions → proxy fallback) with genuine validation checkpoints: '--wait' long-polling, an explicit state machine (READY / BUILDING / CLIENT_ACTION_REQUIRED / CONFIGURATION_ERROR), and a re-poll loop after the user completes an action. It falls short of level 5 because the step numbering is fragmentary — '1b' appears with no labeled Step 2, and there is no coherent end-to-end numbered sequence.	4 / 5
Progressive Disclosure	This is a single-file skill with no references/, scripts/, or assets/ directories, so everything — including the detailed connection-state troubleshooting (clientAction types, polling semantics) and the proxy flag table — is inlined in a ~140-line SKILL.md. Structure exists via headers, but content that would be better split into a reference file is inline, matching the level-3 anchor rather than level 4's 'most content is appropriately placed'.	3 / 5
	Total	14 / 20 Passed

Description

57%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description correctly names the target product and includes an explicit 'Use when' trigger clause, but the capability statement is generic boilerplate that could describe almost any SaaS integration. Replacing 'Manage data, records, and automate workflows' with concrete Bright Security capabilities (scans, scan configurations, issues, projects) and adding natural security-domain trigger terms would substantially improve it.

Suggestions

Replace the generic capability phrase 'Manage data, records, and automate workflows' with concrete Bright Security operations, e.g. 'Run and monitor scans, triage security issues, and manage scan configurations, projects, and organizations.'

Add natural trigger terms users would actually say, such as 'vulnerabilities', 'security scanning', 'DAST', or 'CI/CD security testing', to the 'Use when' clause.

Make the 'when' clause non-circular by describing the situations of use (e.g. 'Use when the user mentions Bright Security, wants to run or check security scans, or triage vulnerability findings') rather than 'interact with Bright Security data'.

Dimension	Reasoning	Score
Specificity	The description names the domain ("Bright Security integration") but its actions — "Manage data, records, and automate workflows" — are generic and not concrete; no domain-specific capabilities like scans, issues, or projects are stated. This matches the anchor 'Names the domain but actions are minimal or generic' rather than the level-3 anchor, which requires 1-2 concrete actions.	2 / 5
Completeness	Both parts are present: a what ("Manage data, records, and automate workflows") and an explicit when ("Use when the user wants to interact with Bright Security data"), satisfying the 'Use when' requirement so it is not capped at 3. It falls short of 5 because the 'what' is vague and the 'when' is circular rather than giving concrete trigger phrases.	4 / 5
Trigger Term Quality	"Bright Security" is the natural phrase a user would say, but the remaining keywords ("data", "records", "workflows") are generic and common synonyms are missing — users would naturally mention scans, vulnerabilities, security testing, or issues. Fits 'Some relevant keywords but missing common variations or synonyms'.	3 / 5
Distinctiveness Conflict Risk	The product name "Bright Security" gives it a clear niche unlikely to trigger for the wrong skill, but the boilerplate capability phrasing ("Manage data, records, and automate workflows") could overlap with any generic integration skill. Mostly distinct with minor overlap risk, matching the level-4 anchor rather than the fully distinct level-5 one.	4 / 5
	Total	13 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: membranedev/application-skills
Path: skills/bright-security/SKILL.md
Revision: f484c82

Reviewed: 16 days ago

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.

bright-security

Table of Contents

Is this your skill?