CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

push-inventory-collector

Generate one customer-hosted collector script that lists agents, MCP servers, or REST APIs, uploads each asset ZIP with POST /push, then finishes with POST /commit. TRIGGER when: the user asks to push inventory, generate a push script, How to Push, self-managed scanner, or download the collector skill. Trigger phrases include "push inventory", "generate a push script", "How to Push", "self-managed scanner", "collector skill", "POST /push", "POST /commit". DO NOT TRIGGER when: creating a pull scanner (skill setup-service-scanner) or running a hosted scan (skill run-service-scan-and-view-results).

Quality

84%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Medium

Suggest reviewing before use

SKILL.md
Quality
Evals
Security

Quality

Content

70%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The skill is exceptionally actionable — verbatim questions, copy-paste code, exact endpoints, and per-language verification — and its workflow is gated and verifiable end to end. Its weakness is size and repetition: the 684-line body restates the same rules across many sections and inlines a large per-provider catalog that belongs in its reference files.

Suggestions

State the Prerequisites and "Ways to run the script" content once (in their own section) and have Steps 5–7 cross-reference it, instead of spelling out the ordering and the full inputs.env block twice.

Move the ~110-line "Catalog of calls" per-provider API details into references/ (e.g. one catalog file, or a file per provider), keeping only the onboarding rule and one worked example in SKILL.md.

Collect the ~30 inline "is a generation failure" prohibitions into a single generation checklist that Step 7 verifies once, instead of repeating each prohibition at every point it could be violated.

DimensionReasoningScore

Conciseness

Noticeably verbose through pervasive duplication rather than concept explanation: "Do not ask \"Does this look fine?\" after writing" appears in both Step 5 and Step 7; the Prerequisites + "Ways to run the script" ordering and inputs.env block are spelled out twice (Steps 5–7 and again in their own sections); "is a generation failure" is repeated roughly 30 times inline; and the 415/boundary rules appear in Step 4, "ZIP and push", "Failures", and "Troubleshooting". Not 3 — the padding is whole duplicated sections, not occasional tightening; not 1 — there is no explanation of concepts Claude already knows and nearly every fact is novel product contract.

2 / 5

Actionability

Fully executable throughout: verbatim customer questions ("What asset type does this scanner configuration accept? Reply with one of: agent, mcp, or rest-api."), copy-paste helpers (`_multipart_zip`, `_unquote_aws`), exact endpoints ("POST {ANYPOINT_BASE}/agent-scanner/api/v1/organizations/{org}/scanner-configurations/{config}/push"), a concrete FAILED block template, and per-language verification commands ("python3 -m py_compile FILE", "bash -n FILE", "node --check FILE"). Python-only snippets paired with "or the same behavior in the language they named" are explicitly justified flexibility, matching anchor 5.

5 / 5

Workflow Clarity

A numbered Step 1–7 sequence with per-step stop conditions, an explicit gate — "[GATE] WAIT for an explicit yes to 'Does this look fine?' before writing files" — a repair loop ("If they say no, ask which row is wrong, fix the table, and ask again"), and post-generation validation ("Do not declare completion until the file parses in the named language and those searches are clean") plus a failure table with a "next:" recovery column. Explicit checkpoints and feedback loops for a batch upload operation — anchor 5.

5 / 5

Progressive Disclosure

The "Reference files" section clearly signals all three real bundle files with read timing ("Read it before writing the upload and commit functions") and references are one level deep (scanner-contract.md only cross-references a sibling). But the ~110-line "Catalog of calls" per-provider API detail and deep AWS-specific rules (AgentCore invoke-URL construction, the `_unquote_aws` code) are inlined in SKILL.md where they clearly belong in the reference files. Not 4 — a substantial separable chunk sits inline; not 2 — structure is otherwise well organized with clearly signaled references.

3 / 5

Total

15

/

20

Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description: it states the full job concretely, gives explicit trigger phrases, and positively disambiguates against the two sibling scanner skills. The only weakness is redundancy — the trigger list is repeated verbatim in a second sentence — and a few natural phrasing variants are absent.

DimensionReasoningScore

Specificity

Names multiple concrete actions at endpoint-level precision — "lists agents, MCP servers, or REST APIs", "uploads each asset ZIP with POST /push, then finishes with POST /commit" — covering the whole job with no gaps. Anchor 5 fits; not 4 because coverage of the actions (list → upload → commit) is comprehensive, not 'minor gaps'.

5 / 5

Completeness

Explicitly answers both: what — "Generate one customer-hosted collector script that lists agents, MCP servers, or REST APIs, uploads each asset ZIP with POST /push, then finishes with POST /commit"; when — "TRIGGER when: the user asks to push inventory, generate a push script, How to Push, self-managed scanner, or download the collector skill" with concrete quoted trigger phrases. Matches anchor 5 exactly; not 4 because the when-clause is fully explicit rather than merely present.

5 / 5

Trigger Term Quality

Good natural-phrase coverage ("push inventory", "How to Push", "self-managed scanner", "collector skill", "download the collector skill"), but the TRIGGER list is restated verbatim in "Trigger phrases include" — pure padding per the no-verbosity guideline — and it leans partly on technical endpoint names ("POST /push", "POST /commit") while missing natural variants like "self-hosted scanner" or "upload inventory". Above anchor 3 (synonyms present), below anchor 5 (a few natural terms missing plus redundant duplication).

4 / 5

Distinctiveness Conflict Risk

Clear push-specific niche with explicit negative boundaries: "DO NOT TRIGGER when: creating a pull scanner (skill setup-service-scanner) or running a hosted scan (skill run-service-scan-and-view-results)". The disambiguation against sibling skills is stated, not implied, so minimal conflict risk — anchor 5 rather than 4.

5 / 5

Total

19

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

skill_md_line_count

SKILL.md is long (685 lines); consider splitting into references/ and linking

Warning

Total

15

/

16

Passed

Repository

mulesoft/mulesoft-dx

Path

skills/push-inventory-collector/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.