CtrlK
BlogDocsLog inGet started
Tessl Logo

identify-security-vuln-discussion

Screen GitHub issues and comments for inadvertent security vulnerability disclosure. Use when: (1) A new issue is created, (2) An issue body is edited, (3) A comment is added or edited, (4) Part of issue intake pipeline. Prevents bypass by editing clean issues to add vulnerabilities later. If a vulnerability is detected in title/body, closes the issue and tags @netwrix/security. If detected in a comment, deletes the comment and posts a security notice.

85

2.00x
Quality

80%

Does it follow best practices?

Impact

96%

2.00x

Average score across 3 eval scenarios

SecuritybySnyk

Low

Low-risk findings worth noting

SKILL.md
Quality
Evals
Security

Quality

Content

68%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

Highly actionable with concrete, executable gh commands and exact messaging, but the body is held back by redundant restatements across sections and a lack of verification checkpoints for its destructive operations.

Suggestions

Consolidate the repeated bypass/check-all-comments rationale into a single statement in the Task or Notes section to remove redundancy across Task, Important Principles, and Notes.

Add verification steps after destructive actions (e.g., re-fetch the comment to confirm deletion, confirm the issue state is CLOSED) to create a validate-then-proceed feedback loop.

Trim the Notes section to points not already covered in Actions and Important Principles to improve token efficiency.

DimensionReasoningScore

Conciseness

Mostly operational but noticeably redundant — the bypass rationale ('editing clean issues to add vulnerabilities later') and 'check all comments' guidance recur across the Task, Important Principles, and Notes sections, and the exact-comment emphasis is restated multiple times.

3 / 5

Actionability

Provides fully executable, copy-paste-ready gh commands for every scenario (gh issue view/comment/close, gh api DELETE) along with the exact comment bodies to post.

5 / 5

Workflow Clarity

Steps are clearly sequenced by scenario, but this is a destructive skill (deleting comments, closing issues) with no verification or feedback loop confirming each action succeeded; per the rubric, missing validation for destructive operations caps this dimension at 3.

3 / 5

Progressive Disclosure

Single-file skill with no bundle files, organized into clear labeled sections and no nested references; the small inline workflow-config YAML is reasonably placed, leaving only minor organization gaps.

4 / 5

Total

15

/

20

Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description that concretely states multiple actions and gives explicit, multi-condition trigger guidance for both what and when. Minor room for richer synonym coverage in the trigger terms, but overall highly specific and distinctive.

DimensionReasoningScore

Specificity

Lists multiple concrete actions — 'Screen GitHub issues and comments', 'closes the issue and tags @netwrix/security', 'deletes the comment and posts a security notice' — giving comprehensive coverage of the skill's behavior.

5 / 5

Completeness

Explicitly answers both what ('Screen GitHub issues and comments for inadvertent security vulnerability disclosure') and when (a four-item 'Use when' clause with concrete trigger phrases).

5 / 5

Trigger Term Quality

Provides explicit natural trigger events ('A new issue is created', 'An issue body is edited', 'A comment is added or edited', 'Part of issue intake pipeline') with good coverage, though it is event-based rather than rich in synonyms or file extensions.

4 / 5

Distinctiveness Conflict Risk

The combination of GitHub issue/comment screening for inadvertent security disclosure is a clear niche with distinct triggers and minimal overlap risk with other skills.

5 / 5

Total

19

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository
netwrix/docs
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.