picoclaw-self-pen-testing

Picoclaw-only local posture-review skill focused on read-only findings and safe operator remediation guidance.

Quality

67%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/picoclaw-self-pen-testing/SKILL.md

Quality

Content

77%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The skill body is highly actionable with a well-sequenced, validated verification workflow, but it is padded by an oversized inline script whose referenced lib dependencies are missing from the bundle. Splitting the script into a referenced file and shipping the lib/ files would tighten conciseness and progressive disclosure.

Suggestions

Move the multi-step release-verification script into a referenced file (e.g. references/verify-release.sh) and keep only the one-line summary plus pointer inline, to improve conciseness and progressive disclosure.

Ship the missing ../lib/self_pen_test.mjs and ../lib/format.mjs files the script imports, or remove the imports, so bundle references resolve.

Move the hardcoded version (0.0.5) and pinned pubkey SHA out of the inline prose into a versioned reference to avoid time-sensitive content inflating the overview.

Dimension	Reasoning	Score
Conciseness	The body carries useful install/usage/validation commands but is dominated by a ~70-line inline release-verification script with a hardcoded version and pinned pubkey SHA that should live in a reference, adding time-sensitive padding Claude doesn't need inline.	2 / 3
Actionability	Commands are concrete and copy-paste ready — install via npx skills, the full signed-verification bash block, 'node scripts/self_pen_test.mjs --profile ...', and validation commands — fully executable with specific examples.	3 / 3
Workflow Clarity	The verification workflow is explicitly sequenced with validation checkpoints (pubkey fingerprint check, signature verify, checksum compare, 'Only install… after this verification succeeds'), matching the clear-sequence-with-explicit-validation anchor.	3 / 3
Progressive Disclosure	Structure exists (sections + a scripts/ file) but the large verification script is inline content that should be a referenced file, scripts/self_pen_test.mjs imports ../lib/*.mjs files that are absent from the bundle, and no references/ directory is used.	2 / 3
	Total	10 / 12 Passed

Description

57%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is on-domain and reasonably specific to Picoclaw posture review, but it lacks a natural trigger clause and concrete action verbs. Adding a 'Use when...' sentence with natural terms would lift completeness and trigger-term quality.

Suggestions

Add a 'Use when...' trigger clause naming natural user phrasing, e.g. 'Use when reviewing Picoclaw posture, hardening a Picoclaw profile, or auditing local security settings.'

Replace abstract phrasing ('posture-review skill focused on read-only findings') with concrete actions like 'Flags public Web UI exposure, disabled UI auth, unsigned verification mode, and plaintext secrets, and suggests safe operator remediations.'

Include common natural keywords users would actually say (e.g. 'security review', 'audit', 'hardening') alongside the technical 'posture-review'.

Dimension	Reasoning	Score
Specificity	Names the posture-review domain and a couple of action qualities ('read-only findings', 'safe operator remediation guidance') but lists no concrete multiple actions, matching the 'names domain and some actions, but not comprehensive' anchor.	2 / 3
Completeness	It states what the skill does but has no 'Use when...' trigger clause, which the guidelines cap at 2.	2 / 3
Trigger Term Quality	'posture-review', 'findings', and 'remediation' are somewhat technical, with 'Picoclaw' as the niche keyword, but common natural variations a user would say are missing.	2 / 3
Distinctiveness Conflict Risk	'Picoclaw-only' scopes it to a distinct niche with tool-specific triggers, making it unlikely to fire for the wrong skill.	3 / 3
	Total	9 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: prompt-security/clawsec
Path: skills/picoclaw-self-pen-testing/SKILL.md
Commit: c6194eb

Reviewed: 14 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.