picoclaw-traffic-guardian

Picoclaw runtime traffic monitoring baseline for lightweight AI gateway proxy inspection, egress detection, and posture integration.

Quality

72%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/picoclaw-traffic-guardian/SKILL.md

Quality

Content

77%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a well-structured, actionable spec with strong validation workflows, but it carries a large version-locked verification script inline and references a SPEC.md that is not present in the bundle, slightly hurting conciseness and progressive disclosure.

Suggestions

Move the release-verification script into a scripts/ or references/ file and keep only the invocation + key validation gates inline to reduce token cost and version-lock drift.

Ship the referenced SPEC.md (or remove/replace the reference with content that exists in the bundle) so progressive-disclosure references resolve to real files.

Pull the hardcoded VERSION and pubkey fingerprint out of the body or into a versioned reference block so the SKILL.md does not carry time-sensitive values directly.

Dimension	Reasoning	Score
Conciseness	The body is mostly lean and avoids explaining concepts Claude already knows, but the ~70-line release-verification script with a hardcoded VERSION="0.0.1-beta5" and pinned pubkey SHA256 is version-locked padding that inflates a baseline spec, keeping it at the mostly-efficient anchor rather than the lean anchor 3.	2 / 3
Actionability	Gives copy-paste-ready executable guidance — the npx install command and a complete verification script using real curl, openssl pkeyutl -verify, and jq commands — matching the fully-executable anchor rather than the pseudocode anchor at 2.	3 / 3
Workflow Clarity	The verification flow is a clearly sequenced process with explicit validation checkpoints (fingerprint mismatch, signature verify, checksum verify) and a hard gate ("Only install or extract the archive after this verification succeeds"), with set -euo pipefail error exits, fitting the clear-sequence-with-validation anchor.	3 / 3
Progressive Disclosure	Sections are well-organized and reference SPEC.md and placeholder folders, but the referenced SPEC.md is not actually shipped in the bundle and the long verification script is inline rather than split out, so references are present but not cleanly backed by real one-level files.	2 / 3
	Total	10 / 12 Passed

Description

67%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and distinct but reads as an internal spec title rather than user-facing trigger copy: it names concrete capabilities yet omits any "Use when..." guidance and leans on jargon users would not naturally say.

Suggestions

Add an explicit trigger clause, e.g. "Use when the user asks to monitor, inspect, or audit AI gateway traffic for the Picoclaw runtime."

Soften jargon like "posture integration" and "egress detection" with natural phrasing users would actually say (e.g. "detect outbound data leaks", "export a security posture profile").

Dimension	Reasoning	Score
Specificity	Lists several concrete actions — "proxy inspection", "egress detection", "posture integration", and "traffic monitoring baseline" — matching the multiple-specific-actions anchor rather than the single-domain anchor at 2.	3 / 3
Completeness	Clearly answers what the skill does but lacks any "Use when..." trigger clause, so the "when" is only implied — the rubric caps completeness at 2 for missing explicit trigger guidance.	2 / 3
Trigger Term Quality	Contains relevant domain keywords ("traffic monitoring", "AI gateway proxy inspection", "egress detection") but leans on technical jargon like "posture integration" that a user would rarely say naturally, so it misses the broad natural-term coverage of anchor 3.	2 / 3
Distinctiveness Conflict Risk	The Picoclaw-specific niche and unique proper nouns carve a clear role unlikely to fire for unrelated skills, fitting the clear-niche anchor despite potential overlap with sibling picoclaw skills.	3 / 3
	Total	10 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: prompt-security/clawsec
Path: skills/picoclaw-traffic-guardian/SKILL.md
Commit: c6194eb

Reviewed: 14 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.