CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

security-cleanup-inspector

Removes app bloat, secures data, and ensures failures are visible. Use this skill to safely eliminate dead code or unused resources, secure vulnerabilities like hardcoded API keys, fix silent exceptions (empty catch blocks), convert heavy assets to WebP, and ensure logs do not contain PII.

Quality

86%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

78%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, dense skill body: clear constraints taxonomy (always/ask/never), a five-step workflow with approval and verification gates, and concrete Gradle/Timber commands. The main improvements are naming the exact build/test commands in the VERIFY step and adding an explicit failure-recovery loop.

Suggestions

In the VERIFY step, replace 'Build the app and run tests' with the exact commands (e.g., './gradlew assembleDebug' and './gradlew testDebugUnitTest') so the guidance is fully executable.

Add an explicit error-recovery loop to VERIFY, e.g., 'If the build or tests fail after deletion, restore the removed code and re-verify before presenting,' to earn a top workflow-clarity score for a destructive-operation skill.

Trim the persona framing and Philosophy mottos to a single decision-heuristic line to reduce stylistic tokens that don't change behavior.

DimensionReasoningScore

Conciseness

The body is dense and prescriptive with no explanation of concepts Claude already knows — it never explains what dead code or catch blocks are. Minor instances that could be trimmed: the 'The Inspector' 🕵️ persona framing and the Philosophy mottos, which are stylistic rather than strictly informational. This fits 'efficient; minor instances of over-explanation that could be trimmed' (4) rather than 'every token earns its place' (5).

4 / 5

Actionability

Mostly executable guidance: exact commands ('./gradlew ktfmtFormat', './gradlew lintDebug'), a concrete logger swap ('Timber.e(e)'), destinations for secrets ('local.properties' or 'BuildConfig'), and a Conventional Commits example. The gap is step 4's 'Build the app and run tests', which names neither the build nor the test command, keeping it just below fully copy-paste ready (5).

4 / 5

Workflow Clarity

The SCAN → SELECT & PROPOSE → SECURE & CLEAN → VERIFY → PRESENT sequence is clear with strong validation checkpoints for a destructive skill: compiler confirmation before deleting ('Run ./gradlew lintDebug to explicitly confirm... before deleting'), a user-approval gate before changes, post-change formatting, and a build/test check. It falls short of a 5 only because there is no explicit feedback loop saying what to do when verification fails (e.g., revert or fix and re-verify).

4 / 5

Progressive Disclosure

The skill is under 50 lines with no bundle files (references/, scripts/, assets/ do not exist) and no need for external references; the body is cleanly organized into Goal, Constraints, Instructions, and Examples sections, each short and self-contained. Per the rubric's guidance for simple, single-purpose skills under 50 lines, this scores 5 on well-organized sections alone.

5 / 5

Total

17

/

20

Passed

Description

88%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description: third-person voice, comprehensive and concrete action list, and an explicit 'Use this skill to...' trigger clause covering all five capabilities. Its only weaknesses are slightly generic opening verbs ('secures data') and a handful of missing natural synonyms a user might say.

DimensionReasoningScore

Specificity

The description lists multiple specific concrete actions: 'safely eliminate dead code or unused resources, secure vulnerabilities like hardcoded API keys, fix silent exceptions (empty catch blocks), convert heavy assets to WebP, and ensure logs do not contain PII'. Coverage is comprehensive across the skill's three pillars (bloat, security, observability), matching the anchor for multiple specific concrete actions.

5 / 5

Completeness

It explicitly answers both questions: what ('Removes app bloat, secures data, and ensures failures are visible') and when ('Use this skill to safely eliminate dead code... fix silent exceptions... convert heavy assets to WebP...'), with concrete trigger conditions for each capability. The 'Use this skill to' clause with enumerated concrete triggers matches the anchor for a 5.

5 / 5

Trigger Term Quality

Good natural keyword coverage — 'dead code', 'unused resources', 'hardcoded API keys', 'empty catch blocks', 'WebP', 'PII', 'app bloat' — but a few common user phrasings are missing (e.g., 'unused imports', 'secrets/tokens in code', 'cleanup', 'silent failures/crashes'). This sits between 'good keyword coverage; a few natural terms missing' (4) and comprehensive synonym coverage (5), closer to 4.

4 / 5

Distinctiveness Conflict Risk

The niche (app bloat removal, secret hardening, silent-exception fixes, asset conversion) is distinct with low conflict risk against most skills. However, phrases like 'secures data' and general vulnerability-cleanup framing could overlap with broader security-review or refactoring skills, keeping it at 'mostly distinct; minor overlap risk' rather than fully distinct.

4 / 5

Total

18

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

nekomangaorg/Neko

Path

.agents/skills/inspector/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.