CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

secure-mule-app

Configure and implement Mule secure properties for encrypting sensitive data in Mule applications. Use this when the user wants to use/implement/add/configure Mule secure properties, secure configuration, or encrypt credentials in their Mule project.

60

Quality

76%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

High

Do not use without reviewing

Fix and improve this skill with Tessl

tessl review fix ./skills/mule-development/secure-mule-app/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

57%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body delivers highly concrete, executable guidance across a well-sequenced 15-step workflow, with real commands and before/after examples. Its weaknesses are structural: duplication inflates token cost, post-change validation for a batch-modification workflow exists only as closing reminders rather than checkpoints, and everything — including reference-style material like naming conventions and templates — is inlined in one long file.

Suggestions

Add an explicit validation checkpoint after encryption and file updates (e.g., decrypt a sample value with the tool and verify the app resolves ${secure::} placeholders, with a fix-and-retry loop) instead of leaving testing only as a final-summary reminder (workflow_clarity).

Consolidate the repeated .gitignore guidance (Steps 9, 13, 14, and Important reminders) into one step and state the JAR download URL once — the same content currently appears 2-4 times (conciseness).

Move the property-key naming rules (Step 7) and the global-configs.xml/pom.xml templates into references/ files linked from the main workflow, shortening SKILL.md to an overview (progressive_disclosure).

DimensionReasoningScore

Conciseness

The body is mostly tight, actionable procedure, but there is real duplication: the JAR download URL appears twice in Step 3, .gitignore guidance is repeated across Steps 9, 13, and 14 and again in 'Important reminders', and Step 15's checklist largely restates prior steps. Fits 'mostly efficient but could be tightened' rather than the padded verbosity of a 2.

3 / 5

Actionability

Concrete copy-paste commands (curl/wget, the java secure-properties-tool invocation, pom dependency coordinates) and before/after XML examples cover the common cases. Minor gaps keep it below 5: Step 4's scan is a pattern list with no executable method, and the global-configs template leaves ALGORITHM/MODE placeholders without explicitly instructing substitution of the user's chosen values.

4 / 5

Workflow Clarity

Fifteen clearly sequenced steps with a user-confirmation gate (Step 6) and a JAR verification check, but this is a batch operation (mass file modification plus batch encryption) whose only post-change verification sits in final-summary reminders ('Test the application...', 'Verify that property names match') rather than structured validate-then-fix checkpoints. Per the rubric's cap for batch operations without explicit validation loops, this cannot score above 3; it is above 2 because the sequence and error-handling section are otherwise well defined.

3 / 5

Progressive Disclosure

A single ~340-line SKILL.md with no references/ or assets/ bundle files; well-organized sections, but content that could be split out (property-key naming rules, XML templates, detection pattern lists) is inlined. 'Some structure but content that should be separate is inline' fits better than 2 (headers and sequencing are clear) or 4 (nothing is offloaded to separate files).

3 / 5

Total

13

/

20

Passed

Description

82%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description: it states concrete capabilities in third person and provides an explicit, well-phrased 'Use this when...' trigger clause covering the natural ways a user would request this task. The only gap is that the 'what' stays at the level of 1-2 actions rather than enumerating the fuller capability set (scanning, encrypting, updating project files).

DimensionReasoningScore

Specificity

Names the domain ('Mule secure properties') and 1-2 concrete actions ('Configure and implement... encrypting sensitive data'), but does not list the several specific actions the skill performs (scanning XML/properties files, creating .secure.properties, updating pom.xml). Fits the score-3 anchor; not 4 because coverage of actions is not 'several specific' ones.

3 / 5

Completeness

Clearly answers 'what' ('Configure and implement Mule secure properties for encrypting sensitive data in Mule applications') and 'when' with an explicit 'Use this when the user wants to...' clause containing concrete trigger phrases — a direct match for the score-5 anchor. Not below 5: neither half is vague or missing.

5 / 5

Trigger Term Quality

Natural phrases users would say are present ('Mule secure properties', 'secure configuration', 'encrypt credentials', plus use/implement/add/configure variants). Not 5 because common synonyms like 'passwords', 'secrets', or 'hide/mask credentials' are missing.

4 / 5

Distinctiveness Conflict Risk

A clear Mule/MuleSoft-specific niche ('Mule secure properties', 'Mule project', 'credentials') with distinct triggers; minimal conflict risk with any other skill. Third-person voice is used, so no voice penalty applies.

5 / 5

Total

17

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

mulesoft/mulesoft-dx

Path

skills/mule-development/secure-mule-app/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.