CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

netalertx-plugin-review

Read when reviewing a plugin PR or auditing an existing plugin script (server/plugins/*/script.py or equivalent). Covers four checks not already mechanically enforced by test_plugin_conventions.py - plugin scripts embedding their own raw SQL instead of an existing/new model method, suspicious/attacker-influenced plugin data not being logged, a new dependency not reaching every build target, and scanPresence correctness for a roster/inventory-style plugin - plus worked real-PR examples.

Quality

92%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

The canonical home for this skill is plugin-review in netalertx/NetAlertX

SKILL.md
Quality
Evals
Security

Quality

Content

82%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A strong reviewer checklist: dense with genuinely non-obvious, codebase-specific knowledge (exact file paths, line numbers, collation facts, CI job names) and fully actionable fixes demonstrated through a real worked PR. Its weaknesses are presentational — long parenthetical digressions that could be trimmed, and only one of the four checks formatted as a numbered review flow.

Suggestions

Convert the logging, dependency, and scanPresence checks into the same short numbered review-flow format used for the raw-SQL check, so a reviewer can follow one consistent step order across all four checks.

Trim the long parenthetical asides (the GraphQL rationale, the api_server_start.py rate-limiting precedent, and the MkDocs parser detail in the Scope section) to their one-line decision-relevant core — the facts are valuable but the sentences are two to three times longer than needed.

Consider moving the two worked-example sections (PR #1788 and the generalized broadcast-protocol example) into a references/ file with a one-line pointer per check, keeping SKILL.md to the check definitions and review flows.

DimensionReasoningScore

Conciseness

Nearly every sentence carries non-obvious codebase knowledge (e.g. 'devMac/eveMac/sesMac/scanMac/devParentMAC are declared COLLATE NOCASE at the column level', the five-plugin exception list, the devcontainer regeneration flow) rather than concepts Claude already knows, so it assumes competence. Not 5: several long parenthetical digressions — the GraphQL rationale, the 'per existing precedent: api_server_start.py's unauthorized-access-attempt alert fires unconditionally' aside, and the MkDocs parser explanation — could be tightened without losing information. Not 3: there is no padded explanation of known concepts; it is well above the midpoint.

4 / 5

Actionability

Guidance is fully concrete: exact fixes ('Fix: DeviceInstance().getByMac(mac) is not None, delete the raw SQL'; 'add DeviceInstance.getAllByName(name) returning every match'), precise locations ('server/models/device_instance.py:102-105', 'server/plugin.py:769-791'), exact gating conditions ('fire only on "new" or "watched-changed", never on "watched-not-changed"'), and specific files to check ('.devcontainer/Dockerfile', 'Dockerfile.debian', 'install/ubuntu24/requirements.txt'). Per the code_vs_instruction note, this instruction-only skill's guidance is as actionable as copy-paste code. Not 4: there are no gaps — the worked PR #1788 example covers the common case end-to-end with both fix shapes.

5 / 5

Workflow Clarity

The raw-SQL check has a clear 4-step numbered review flow with the key checkpoint ('Check the collation the query relies on... rather than assuming'), and each other check states what to verify, the failure mode, and the fix. Not 5: only one of the four checks is a numbered sequence — the logging, dependency, and scanPresence checks are well-specified prose but lack an equivalent stepwise review order, so a reviewer must assemble their own checklist order. Not 3: the sequences that exist are coherent with real checkpoints, above the midpoint.

4 / 5

Progressive Disclosure

The body is well-organized into clearly headed sections (Scope, then one section per check, each with its worked example) and appropriately defers to existing resources by name ([[plugin-development]], [[plugin-readme]], test_plugin_conventions.py, docs/PLUGINS_IMPORT_BEHAVIOR.md) instead of duplicating them. Not 5: no bundle files exist and the ~60-line body keeps all four checks' detail inline where the two worked-example sections could plausibly live in reference files; it also slightly exceeds the under-50-line simple-skill threshold. Not 3: structure is good and references are clearly signaled, not buried.

4 / 5

Total

17

/

20

Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is exemplary: it states an explicit use-trigger, enumerates all four covered checks concretely, includes the target file path, and cleanly distinguishes itself from mechanically enforced conventions. It uses third person with no fluff; the length is dense with information rather than padding.

DimensionReasoningScore

Specificity

The description lists multiple specific concrete checks — 'plugin scripts embedding their own raw SQL instead of an existing/new model method, suspicious/attacker-influenced plugin data not being logged, a new dependency not reaching every build target, and scanPresence correctness for a roster/inventory-style plugin' — comprehensively covering what the skill does. Not the level below (4): there are no coverage gaps; all four checks are enumerated with their distinguishing detail.

5 / 5

Completeness

Both 'what' and 'when' are answered explicitly and concretely: 'Read when reviewing a plugin PR or auditing an existing plugin script (server/plugins/*/script.py or equivalent)' is an explicit trigger clause, and the four checks plus 'worked real-PR examples' state exactly what it does. Not the level below (4): the 'when' is not merely present but specific and concrete, matching the top anchor.

5 / 5

Trigger Term Quality

Natural trigger phrases a reviewer would actually say are comprehensively covered: 'reviewing a plugin PR', 'auditing an existing plugin script', the file path pattern 'server/plugins/*/script.py', plus topic terms like 'raw SQL', 'dependency', 'build target', and 'roster/inventory-style plugin'. Not the level below (4): synonyms are included (roster/inventory, PR/real-PR examples) and no common natural phrasing for this domain is missing.

5 / 5

Distinctiveness Conflict Risk

It carves out a clear niche (plugin review for a specific codebase), explicitly excludes what other checks cover ('not already mechanically enforced by test_plugin_conventions.py'), and its triggers ('plugin PR', 'plugin script', 'scanPresence') would not fire for unrelated skills. Not the level below (4): there is no meaningful overlap risk with closely related skills.

5 / 5

Total

20

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

referenced_paths_exist

Referenced path issues: 1 missing

Warning

Total

15

/

16

Passed

Repository

netalertx/NetAlertX

Path

.github/skills/plugin-review/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.