CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

cobalt-io

Cobalt integration. Manage data, records, and automate workflows. Use when the user wants to interact with Cobalt data.

Quality

69%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/cobalt-io/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

67%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content delivers a largely executable, well-sequenced guide for connecting to Cobalt via the Membrane CLI, with good state handling and a useful proxy fallback. Its main weaknesses are duplicated/empty sections, a padded intro paragraph, and broken internal step references ("Step 2" and "1b") that undermine navigation.

Suggestions

Fix the internal step references: either number the workflow steps explicitly (1a/1b/2...) so "skip to **Step 2**" has a real target, or rewrite as "skip to **Searching for actions**".

Actually populate "Popular actions" with 3–5 concrete, commonly used Cobalt action examples (e.g., list findings, get asset inventory) and remove the duplicated discovery command, or delete the section and fold it into "Searching for actions".

Tighten the intro to one sentence ("Cobalt.io is a pentesting-as-a-service platform; official docs at https://cobalt.foo/development/") and delete the filler line "Use action names and parameters as needed."

DimensionReasoningScore

Conciseness

The body is mostly efficient, command-driven prose, but contains unnecessary material: a four-sentence paragraph describing what Cobalt.io is, the filler line "Use action names and parameters as needed.", and the "Popular actions" section that repeats the discovery command already shown under "Searching for actions". This matches anchor 3 (mostly efficient with some unnecessary explanation) rather than 4.

3 / 5

Actionability

Commands are concrete and executable throughout — install, login (including headless completion), connection ensure, poll with --wait, action list/run with JSON input, and the proxy request flag table. It falls short of anchor 5 because the "Popular actions" heading lists no actual actions and there is no worked end-to-end example with a real action id and input.

4 / 5

Workflow Clarity

The install → login → connect → poll → search → run sequence is clear, with explicit state handling (READY / CLIENT_ACTION_REQUIRED / CONFIGURATION_ERROR) and a genuine feedback loop ("poll again... to check if the state moved to READY"). It is not 5 because the step references are incoherent — "skip to **Step 2**" points to a step that is never defined, and section "1b" has no 1a or 2.

4 / 5

Progressive Disclosure

The single-file body (~140 lines) is well-sectioned with no nested references, and no bundle files exist to reorganize. It fits anchor 4 (good structure, most content appropriately placed) rather than 5 because the "Popular actions" section is empty and the clientAction state-machine detail is arguably reference material.

4 / 5

Total

15

/

20

Passed

Description

57%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description correctly names the target app and includes an explicit "Use when" clause, but its capability statement is generic integration boilerplate. It neither conveys what Cobalt actually is (a pentesting platform) nor the domain vocabulary that would help it trigger on real user requests about pentests and security findings.

Suggestions

Replace "Manage data, records, and automate workflows" with Cobalt-specific actions, e.g., "Manage Cobalt pentest projects, findings, and asset inventory; run and automate Cobalt API workflows."

Add natural trigger terms from the pentesting domain so the skill fires on real requests, e.g., "Use when the user mentions Cobalt, pentests, pentest findings, vulnerability reports, or security testing results."

Include a few synonyms or related terms (PTaaS, security researchers, CVEs/findings) to improve trigger coverage and distinguish this skill from generic data-integration skills.

DimensionReasoningScore

Specificity

The domain (Cobalt) is named, but the actions — "Manage data, records, and automate workflows" — are generic CRUD boilerplate that could describe any business app integration. It does not reach anchor 3 because no concrete, app-specific action (e.g., managing pentest findings or vulnerabilities) is stated.

2 / 5

Completeness

Both "what" ("Manage data, records, and automate workflows") and "when" ("Use when the user wants to interact with Cobalt data") are explicitly present. It fits anchor 4 rather than 5 because the "when" clause is generic and the "what" lacks concrete trigger phrases.

4 / 5

Trigger Term Quality

"Cobalt" is a strong natural trigger term and appears twice, but the description misses the vocabulary Cobalt users would actually say — pentest, findings, vulnerabilities, security posture. Some relevant keywords exist, but common variations and domain synonyms are missing, matching anchor 3 rather than 4.

3 / 5

Distinctiveness Conflict Risk

The named app ("Cobalt integration", "interact with Cobalt data") creates a clear niche with minimal conflict risk against unrelated skills. It stays at anchor 4 rather than 5 because the templated "Manage data, records, and automate workflows" phrasing is boilerplate that overlaps with any generic data-management integration skill.

4 / 5

Total

13

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository

membranedev/application-skills

Path

skills/cobalt-io/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.