CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

kingfisher

Find, live-validate, map the blast radius of, and revoke leaked secrets with Kingfisher (MongoDB) — across a local repo, Git history, a GitHub/GitLab/Bitbucket org, S3/GCS, Docker images, Slack, Jira, Confluence, Teams, or Postman. Covers local CLI scanning, direct validate/revoke without a scan, baseline management (track only new secrets), kingfisher.yaml policy, CI diff-scan gates, and pre-commit/Husky hooks. Use when asked to "scan for secrets", "is this key still live", "what can this credential reach", "revoke this token", "did we leak a secret", or "block new secrets in CI". Pattern-only secret scan bundled with a CVE pass → /platform-skills:trivy. Secrets-context safety in workflow YAML → /platform-skills:zizmor. Storing/rotating secrets inside the cluster → /platform-skills:secrets.

Quality

89%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Low

Low-risk findings worth noting

The canonical home for this skill is kingfisher in nitinjain999/platform-skills

SKILL.md
Quality
Evals
Security

Quality

Content

77%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is exceptionally actionable and safety-conscious, with executable commands for every mode and rigorous validation gates around destructive operations. Its two real weaknesses are redundancy (ownership routing, the 205/200 trade-off, and authorization rules each stated 3-4 times) and a broken disclosure structure: the repeatedly-cited references/kingfisher.md is absent from the bundle, so the deferred detail is unreachable.

Suggestions

State each cross-reference routing once (the ownership-boundary table is the natural home); drop the duplicate routing lines from Layer 1, the intent-classification table, and the Cross-references section, cutting roughly 30-40 lines of repetition.

Ship references/kingfisher.md (bootstrap, CLI surface, kingfisher.yaml schema, platform-target auth env vars, CI templates Options A-C, Husky variant) — the body marks it required reading ten-plus times but the file is missing, so every section pointer and the CI-mode templates are dead ends.

Consolidate the 205-vs-200 threshold guidance into the Layer 3 trade-off block and reference it from ci mode / Never-do with one line each, instead of re-deriving the full trade-off in each place.

DimensionReasoningScore

Conciseness

Mostly dense, high-value operational guidance with no explanations of concepts Claude already knows, but the same material repeats noticeably: the trivy/zizmor/secrets routing appears in the ownership table, Layer 1 wizard, intent-classification table, and the Cross-references section; the 205-vs-200 gate trade-off is explained three times (Layer 3, ci mode, Never-do); and the authorization-confirmation rule is stated four times. Fits the 3 anchor ('mostly efficient but ... could be tightened') — the repetition is deliberate enforcement language, so it is above 2's 'several unnecessary explanations', but too redundant for 4's 'minor instances'.

3 / 5

Actionability

Every mode ships copy-paste-ready commands: `kingfisher scan /path/to/code --git-history=none`, `kingfisher validate --rule github-pat "ghp_..."` with `--var` for multi-component validators, revoke examples, baseline create/use pairs, a full `kingfisher config init` command, and a complete .pre-commit-config.yaml block. Specific examples cover the common cases per the 5 anchor.

5 / 5

Workflow Clarity

Clear mode dispatch → three-layer wizard → per-mode procedures with explicit validation checkpoints and feedback loops for destructive operations: revoke requires a three-part gate (validated live, owner identified, replacement ready) and mandates re-running validate afterward to confirm the provider actually applied the kill; triage is a numbered decision tree; baseline gotchas are stated before running. This is exactly the 5 anchor's 'explicit validation steps; feedback loops for error recovery' — the destructive-op cap of 3 does not apply because validation is present.

5 / 5

Progressive Disclosure

References are clearly signaled and one level deep with section-level pointers ("references/kingfisher.md → CI integration (Options A–C)", "→ Baseline", "→ Pre-commit and Husky"), but scored against the actual bundle: `references/kingfisher.md` — cited ~10 times and declared required reading ("Read references/kingfisher.md before responding") — does not exist in the bundle (only scripts/pre-commit.sh, which is real and matches its description). A missing primary reference plus ~370 lines of inlined wizard/trade-off content that belongs in that reference fits the 3 anchor ('could be better organized ... content that should be separate is inline'); it exceeds 2 because structure and signaling are good, but fails 4 because a missing core file is more than a 'minor organization gap'.

3 / 5

Total

16

/

20

Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

An exemplary description: verb-first concrete capability list, a broad but precisely enumerated target surface, an explicit 'Use when' clause with quoted natural trigger phrases, and explicit routing that separates this skill from adjacent trivy/zizmor/secrets skills. Third-person/imperative voice throughout, with no vague filler or over-claims.

DimensionReasoningScore

Specificity

Concrete actions are enumerated directly ("Find, live-validate, map the blast radius of, and revoke leaked secrets") and coverage is comprehensive: local CLI scanning, direct validate/revoke without a scan, baseline management, kingfisher.yaml policy, CI diff-scan gates, and pre-commit/Husky hooks, across twelve named target types (GitHub/GitLab/Bitbucket org, S3/GCS, Docker images, Slack, Jira, Confluence, Teams, Postman). Matches the 5 anchor (multiple specific concrete actions, comprehensive coverage); no anchor above exists and it clearly exceeds the 4 anchor's 'minor gaps'.

5 / 5

Completeness

Explicitly answers both: what ("Find, live-validate, map the blast radius of, and revoke leaked secrets... Covers local CLI scanning, ... baseline management ..., kingfisher.yaml policy, CI diff-scan gates, and pre-commit/Husky hooks") and when ("Use when asked to 'scan for secrets'..."). This mirrors the 5 anchor's what+when with concrete trigger phrases; it is not the 4 anchor's 'when could be more explicit'.

5 / 5

Trigger Term Quality

Quotes natural user phrasings verbatim: "scan for secrets", "is this key still live", "what can this credential reach", "revoke this token", "did we leak a secret", "block new secrets in CI" — covering secret/key/credential/token synonyms users would actually say. Comprehensive natural-term coverage per the 5 anchor; not merely 'good coverage with a few missing' (4).

5 / 5

Distinctiveness Conflict Risk

A clear niche (live validation, blast-radius mapping, and revocation of leaked secrets — versus pattern-only scanning) with explicit disambiguation routing: "Pattern-only secret scan bundled with a CVE pass → /platform-skills:trivy", "Secrets-context safety in workflow YAML → /platform-skills:zizmor", "Storing/rotating secrets inside the cluster → /platform-skills:secrets". Minimal conflict risk per the 5 anchor; the boundaries against adjacent skills are drawn in the description itself.

5 / 5

Total

20

/

20

Passed

Validation

87%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

referenced_paths_exist

Referenced path issues: 10 missing

Warning

Total

14

/

16

Passed

Repository

nitinjain999/platform-skills

Path

plugins/platform-skills/skills/kingfisher/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.