CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

code42

Code42 integration. Manage data, records, and automate workflows. Use when the user wants to interact with Code42 data.

Quality

66%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/code42/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

57%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is strong on executable CLI commands and covers the full lifecycle from installation through action execution and raw API proxying, with useful connection-state handling. Its main weaknesses are organizational: dangling "Step 2" references reveal an incomplete workflow structure, two sections duplicate the same discovery command, and reference-grade detail (state machine, proxy options) is inlined in a long single file.

Suggestions

Fix the dangling "Step 2" references by numbering the actual workflow steps (1. Install, 2. Authenticate, 3. Connect, 4. Discover actions, 5. Run or proxy), or remove the step labels entirely.

Add one concrete worked example, e.g. `membrane action run <real-action-id> --connectionId=... --input '{"query": "..."}' --json`, and correct `membrane login --tenant` to show the expected value.

Move the connection clientAction state-machine detail and the proxy flag table into a separate reference file (e.g. references/connection-states.md) and keep SKILL.md as a lean overview, merging the duplicate "Searching for actions" / "Popular actions" sections.

Trim filler text: drop "Use action names and parameters as needed.", tighten the "Agent Types" note, and remove the marketing sentence about the connection method being fastest.

DimensionReasoningScore

Conciseness

The body is mostly command-focused and efficient, but includes several instances of unnecessary or padded text: the marketing-style paragraph "This is the fastest way to get a connection..." ("This is the fastest way..."), the rambling "Agent Types" note with "etc." and "Those will be used to adjust tooling to be used best with your harness", the filler line "Use action names and parameters as needed.", and a duplicated `action list` command in both "Searching for actions" and "Popular actions". This fits anchor 3 ("mostly efficient but includes some unnecessary explanation or could be tightened") more than anchor 4, where such instances would be minor.

3 / 5

Actionability

The guidance is largely copy-paste ready: `npm install -g @membranehq/cli@latest`, `membrane connection ensure "https://www.code42.com/" --json`, `membrane action run <actionId> --connectionId=CONNECTION_ID --input '{"key": "value"}' --json`, and a complete proxy flag table cover install, auth, connect, discover, run, and raw-request cases. It falls short of anchor 5 because `membrane login --tenant --clientName=<agentType>` is not executable as written (`--tenant` shows no value) and there is no concrete worked example with a real action id and input payload. It is clearly above anchor 3, which expects pseudocode or missing key details.

4 / 5

Workflow Clarity

A rough sequence exists (install → login → connection ensure → poll until READY → search actions → run actions → proxy fallback) and the connection state machine includes a poll-again feedback loop for CLIENT_ACTION_REQUIRED and explicit error-state handling. However, the text repeatedly says "skip to **Step 2**" while no Step 2 (or Step 1a) heading exists — the sections after the connection steps are unlabeled relative to those references — and there is no explicit ordered overview of the end-to-end workflow. This matches anchor 3 ("steps listed but validation gaps; sequence present but checkpoints missing or implicit"); the dangling step references keep it below anchor 4's "clear sequence".

3 / 5

Progressive Disclosure

The single-file body has reasonable section headers, but it is ~145 lines with no bundle files, and moderately deep reference-style content is inlined — the full connection clientAction state-machine breakdown and the proxy flag table are detail that could live in separate reference files with the main file pointing to them. This fits anchor 3 ("some structure but could be better organized... content that should be separate is inline"); the sectioning is better than anchor 2's minimal structure, but the inlined depth and duplicated/overlapping sections ("Searching for actions" vs "Popular actions") keep it below anchor 4.

3 / 5

Total

13

/

20

Passed

Description

61%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description has a clear explicit trigger structure and names a distinctive product, so it will fire for the right requests. However, it is weak on concrete capability details — "Manage data, records, and automate workflows" could describe almost any business integration, and no Code42-specific terminology (legal holds, file events, alerts) appears to help users or the model recognize the skill's scope.

Suggestions

Replace the generic "Manage data, records, and automate workflows" with concrete Code42 capabilities, e.g., "Search file events, manage legal holds and custodians, review security alerts and device activity."

Expand the trigger clause with natural user phrases: "Use when the user mentions Code42, Incytes, legal holds, data-loss investigations, or insider-risk alerts."

Mention the specific record types (users, devices, file events, alerts, audit logs) that appear in the skill body so the description signals actual coverage.

DimensionReasoningScore

Specificity

The description names the domain ("Code42 integration") but the actions are generic — "Manage data, records, and automate workflows" uses vague verbs with no concrete Code42 operations (e.g., legal holds, file events, alerts, device monitoring). It matches anchor 2 ("Names the domain but actions are minimal or generic") better than anchor 3, which requires 1-2 genuinely concrete actions.

2 / 5

Completeness

Both parts are present: the "what" ("Code42 integration. Manage data, records, and automate workflows") and an explicit "when" ("Use when the user wants to interact with Code42 data"). It is not a 5 because the "when" is circular — it restates the product name rather than giving concrete trigger phrases, and the "what" is generic. It exceeds anchor 3 because the "Use when..." clause is explicit rather than weakly implied.

4 / 5

Trigger Term Quality

"Code42" and "data" are relevant keywords a user would say, but coverage stops there — common variations and synonyms a user might naturally use (legal hold, alerts, security events, file events, Incytes, departing employees) are missing. This matches anchor 3 ("Some relevant keywords but missing common variations or synonyms").

3 / 5

Distinctiveness Conflict Risk

Code42 is a specific named product and the trigger centers on it, giving a clear niche with minimal conflict risk against other skills. A user mentioning Code42 data would unambiguously select this skill.

5 / 5

Total

14

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository

membranedev/application-skills

Path

skills/code42/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.