Name: drata
Rating: 55.2 (1 reviews)
Author: membranedev

drata

Drata integration. Manage Controls, Standards, Objectives, Reports, Persons, Risks and more. Use when the user wants to interact with Drata data.

Quality

63%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/drata/SKILL.md

Quality

Content

60%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body delivers solid executable CLI guidance with a clear connection/readiness workflow, but it is undermined by a massively padded entity list that bloats token usage. Moving that catalog to a reference file and trimming the generated "Acceptable..." entries would materially improve quality.

Suggestions

Move the ~280-item entity catalog out of SKILL.md into a references file (e.g. references/entities.md) and keep only the top-level entity groups inline.

Delete the auto-generated "Acceptable Data Security ..." proliferation, which appears to be padding rather than real Drata entities.

Add one fully-resolved example command (real connection id and a concrete --input payload) for running an action so guidance is copy-paste ready.

Dimension	Reasoning	Score
Conciseness	The "Drata Overview" section is a ~280-item bullet list, the bulk of which are auto-generated padding entries (dozens of "Acceptable Data Security ..." variants), making the body noticeably verbose and heavily padded even though the CLI instruction sections are reasonably tight; not 1 because it avoids explaining concepts Claude already knows, and not 3 because the entity-list padding wastes substantial tokens.	2 / 5
Actionability	Provides concrete, executable commands (npm install, membrane login, connection ensure, action run, request) with real flags and a useful popular-actions table, but uses placeholders (CONNECTION_ID, actionId) and a generic --input example, leaving minor gaps; not 5 because common-case examples rely on placeholders rather than fully copy-paste-ready invocations.	4 / 5
Workflow Clarity	A clear sequence (install → authenticate → connect → search → run → proxy) with a readiness feedback loop (poll --wait, handle CLIENT_ACTION_REQUIRED, re-poll) and error-state guidance, though some validation checkpoints are implicit rather than explicit; not 5 because recovery steps are not framed as an explicit checklist.	4 / 5
Progressive Disclosure	Single SKILL.md with well-organized headers and no nested references, but the giant inline entity list is content that arguably belongs in a separate reference file rather than the overview; not 5 because the oversized inline list prevents the overview from staying lean and navigable.	4 / 5
	Total	14 / 20 Passed

Description

66%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is well-formed with explicit what/when guidance and a distinct product niche, but the action language is generic and trigger coverage is narrow. Tightening the verb list and adding common phrasings would lift it from good to strong.

Suggestions

Replace the single generic verb "Manage" with several concrete actions (e.g., "List, create, update, and query Controls, Persons, Risks...") to improve specificity.

Broaden trigger terms with natural synonyms users might say, such as "compliance", "SOC 2", "audit evidence", or "Drata records".

Make the "when" clause more specific than "interact with Drata data" — e.g., "Use when the user wants to query or update Drata compliance data."

Dimension	Reasoning	Score
Specificity	Names the Drata domain and lists many concrete entity types ("Controls, Standards, Objectives, Reports, Persons, Risks"), but relies on a single generic action verb ("Manage ... and more") rather than multiple distinct actions, and "and more" explicitly signals non-comprehensive coverage.	3 / 5
Completeness	Explicitly answers both what ("Manage Controls, Standards, Objectives, Reports, Persons, Risks and more") and when ("Use when the user wants to interact with Drata data"), but the "when" clause is somewhat generic and could be more specific, fitting the both-present-but-could-be-sharper anchor.	4 / 5
Trigger Term Quality	Includes the natural keyword "Drata" and the phrase "interact with Drata data", but offers few synonyms or variations a user might naturally say beyond the product name, matching the "some relevant keywords but missing common variations" anchor.	3 / 5
Distinctiveness Conflict Risk	Tied to a named product ("Drata integration") with distinct triggers, giving it a clear niche and minimal conflict risk with other skills.	5 / 5
	Total	15 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: membranedev/application-skills
Path: skills/drata/SKILL.md
Commit: f484c82

Reviewed: 4 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.