clawtributor

Harness-neutral community incident reporting for AI agents. Contribute to collective security by reporting threats.

Quality

63%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/clawtributor/SKILL.md

Quality

Content

77%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable with clear, validated workflows, but it is hurt by duplicated install sections, a referenced reporting.md file that is absent from the bundle, and inline detail that would benefit from being moved into the referenced file.

Suggestions

De-duplicate the two installation blocks (the 'Vercel Skills Installation' and later 'Installation' sections repeat the same commands).

Provide the missing ./reporting.md bundle file (or remove the dangling reference) and move the full Quick Report Format and submission details into it.

Trim the large ASCII flow diagram to a compact one-line summary to save tokens while preserving the approval-gated submission concept.

Dimension	Reasoning	Score
Conciseness	The body is mostly efficient and avoids over-explaining concepts Claude knows, but installation instructions are duplicated ('Vercel Skills Installation' and a later 'Installation' section repeat the same codex/clawhub commands) and the large ASCII flow diagram could be trimmed.	2 / 3
Actionability	It provides copy-paste-ready, executable guidance throughout: exact install commands, a complete signed-release verification bash script, a full JSON report template, a confirmation-prompt style, and a state.json example.	3 / 3
Workflow Clarity	The submission workflow is explicitly sequenced as Step 1–3 with an approval checkpoint, and the release-verification script has clear validation gates (pubkey fingerprint check, signature verify, checksum compare) with error/exit feedback loops.	3 / 3
Progressive Disclosure	The body signals a one-level reference to [reporting.md](./reporting.md), but no references/ directory or reporting.md bundle file exists — a dead link — and most detail (full report format, verification script) is inline rather than split out.	2 / 3
	Total	10 / 12 Passed

Description

50%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description clearly identifies the skill's domain and intent but omits explicit 'when to use' trigger guidance and only partially enumerates its concrete capabilities, leaving it solid but not exemplary.

Suggestions

Add an explicit 'Use when...' clause with natural triggers, e.g. 'Use when the user wants to report a malicious prompt, vulnerable skill, or tampering attempt.'

Replace 'Harness-neutral' / 'collective security' jargon with concrete user-facing terms that a person would naturally say when requesting the skill.

List the concrete report types (malicious prompts, vulnerable skills/plugins, tampering) in the description rather than only in the body.

Dimension	Reasoning	Score
Specificity	Names the domain ('community incident reporting for AI agents') and one concrete action ('reporting threats'), but is not comprehensive — multiple reportable categories (vulnerabilities, tampering) live only in the body, not the description.	2 / 3
Completeness	It states what the skill does but provides no 'Use when...' clause or equivalent trigger guidance; per the rubric a missing explicit trigger caps completeness at 2.	2 / 3
Trigger Term Quality	'incident reporting' and 'reporting threats' are plausible user phrases, but jargon like 'harness-neutral' and 'collective security' is not natural trigger language and common variations ('report a vulnerability', 'submit a security report') are absent.	2 / 3
Distinctiveness Conflict Risk	'community incident reporting for AI agents' is a fairly specific niche, yet the generic 'reporting threats' phrasing could overlap with broader security skills, so it is not a fully conflict-free trigger.	2 / 3
	Total	8 / 12 Passed

Validation

75%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 12 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
metadata_field	'metadata' should map string keys to string values	Warning
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning
relative_links	Relative link issues: 1 missing	Warning

	Total	12 / 16 Passed

Repository: prompt-security/clawsec
Path: skills/clawtributor/SKILL.md
Commit: c6194eb

Reviewed: 14 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.