Tessl • The management layer for AI agent skills

SkillPublic

secrets

Secrets strategy, External Secrets Operator scaffolding, Sealed Secrets seal/rotate/backup, rotation runbooks, and Kubernetes-side secrets audit.

Quality

76%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/secrets/SKILL.md

Quality

Content

78%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable operational manual: executable commands, complete provider scaffolds, symptom tables, and a validated rotation runbook with verification steps. Its weaknesses are the missing references/secrets.md file that every mode instructs Claude to read, heavy inlining that belongs in that reference, and some repeated handoffs and missing failure-path branches in the rotation workflow.

Suggestions

Create the referenced references/secrets.md (or remove the dangling "Read references/secrets.md" instructions) — as bundled, every mode points to a file that does not exist.

Move the provider-specific SecretStore YAML scaffolds and ESO/Sealed Secrets debug tables into references/secrets.md, keeping SKILL.md as a mode overview with the decision matrix, triggers, and handoffs.

Add failure-path branches to the rotate runbook (e.g. "if the secret is still stale after force-sync, see the eso debug symptom table") and consolidate the trivy/kingfisher handoff into one place to remove duplication.

Dimension	Reasoning	Score
Conciseness	The body is dense with executable commands, YAML scaffolds, and symptom tables, with almost no explanation of concepts Claude already knows. Minor duplication could be trimmed: the trivy/kingfisher handoff is repeated in at least four places, and the force-sync annotate command appears in both the eso and rotate modes.	4 / 5
Actionability	Fully executable, copy-paste-ready kubectl/kubeseal/aws/az commands; complete SecretStore YAML for three providers; symptom→cause→fix tables for both ESO and Sealed Secrets; and concrete verification commands (sha256sum of the secret data, healthz probe, pg_isready). Placeholders are consistently delimited with angle brackets and the interview sections force substitution.	5 / 5
Workflow Clarity	The rotate mode is a clearly sequenced 5-step runbook with explicit verification checkpoints (check last sync, confirm data hash changed, validate app connectivity) and the sealed mode has an interview plus a recovery table. Minor gap: no failure-path branch when verification fails — e.g. what to do if the secret is still stale after force-sync — and the eso debug table is not cross-referenced from the rotate runbook.	4 / 5
Progressive Disclosure	Sections are well-organized by mode and references are clearly signaled ("Read references/secrets.md before responding" in each mode), but the referenced file does not exist in the bundle — every mode's primary reference is dangling. Additionally, the ~475-line body inlines the full provider scaffolds and debug tables that the reference file is meant to hold, so the split between SKILL.md and references is unclear.	3 / 5
	Total	16 / 20 Passed

Description

66%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A specific, tool-anchored description that clearly communicates the skill's five capabilities and is well-differentiated from neighboring skills. Its main weakness is the complete absence of "Use when..." trigger guidance, which caps completeness, and a slightly vague opening phrase.

Suggestions

Add a "Use when..." clause listing explicit triggers, e.g. "Use when working with External Secrets Operator, Sealed Secrets/kubeseal, rotating Kubernetes credentials, or auditing cluster secrets health."

Replace the abstract opening "Secrets strategy" with a concrete action verb (e.g. "Choose between ESO and Sealed Secrets") to remove the one non-specific phrase.

Include common user phrasings such as "sync error", "SecretStore", or "rotate database password" to broaden natural trigger coverage.

Dimension	Reasoning	Score
Specificity	The description names concrete tool-specific actions — "External Secrets Operator scaffolding", "Sealed Secrets seal/rotate/backup", "rotation runbooks", "Kubernetes-side secrets audit" — covering all five skill modes. The opening phrase "Secrets strategy" is abstract and unanchored, which keeps it below the comprehensive anchor 5.	4 / 5
Completeness	The "what" is clear and specific, but the description contains no "Use when..." clause or equivalent explicit trigger guidance, so per the judging guideline completeness is capped at 3.	3 / 5
Trigger Term Quality	Includes natural terms users would say such as "External Secrets Operator", "Sealed Secrets", "seal", "rotate", "backup", and "audit". Common variations like "sync error", "SecretStore", "credential", and "leaked secrets" are absent, matching the "good keyword coverage; a few natural terms missing" anchor rather than anchor 5.	4 / 5
Distinctiveness Conflict Risk	The named tools (External Secrets Operator, Sealed Secrets) form a clear, distinct niche with minimal conflict risk. There is minor overlap risk with secret-scanning skills (trivy, kingfisher) on the broad term "secrets", which keeps it below the "minimal conflict risk" anchor 5.	4 / 5
	Total	15 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning
referenced_paths_exist	Referenced path issues: 4 missing	Warning

	Total	14 / 16 Passed

Repository: nitinjain999/platform-skills
Path: skills/secrets/SKILL.md
Revision: c2e75b7

Reviewed: 17 hours ago

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.

secrets

Table of Contents

Is this your skill?