security-scan

Resolve npm dependency vulnerabilities detected by security scans.

1.25x

Quality

53%

Does it follow best practices?

Impact

97%

1.25x

Average score across 3 eval scenarios

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./frontend/.claude/skills/security-scan/SKILL.md

Quality

Content

60%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is concise and has a clear assessed workflow with a verification checkpoint, but its actionability is undercut by a 'Fix' step that defers entirely to rules, and its progressive disclosure is broken because the referenced rule files do not exist in the bundle.

Suggestions

Provide the referenced rule files (vuln-direct-deps.md, vuln-transitive-deps.md) under references/ or inline the key fix patterns so the core step is self-contained.

Add at least one concrete inline fix example (e.g. an npm 'overrides' snippet for a transitive dep) to lift actionability.

Fix the Quick Reference paths so they point to real files, or convert them into inline guidance, to make navigation resolve.

Dimension	Reasoning	Score
Conciseness	The body is lean and assumes Claude's competence, with no padding explaining what CVEs or npm are; only minor tightening opportunities exist (e.g. the 'Quick Reference' and 'Tips' sections slightly overlap the workflow).	4 / 5
Actionability	It provides some concrete commands (`npm view <package> versions --json`, the bun verify block) but the core 'Fix' step defers to rules with no inline patterns, leaving the most important guidance incomplete.	3 / 5
Workflow Clarity	The Assess -> Explore -> Fix -> Verify sequence is clear and the Verify step is an explicit validation checkpoint with 'All must pass'; minor gap is that the Fix step points elsewhere without inline patterns.	4 / 5
Progressive Disclosure	The body references `vuln-direct-deps.md`, `vuln-transitive-deps.md`, and a `rules/` directory, but no such references/ or bundle files exist, so the navigation points to missing materials and the structure is unresolved.	2 / 5
	Total	13 / 20 Passed

Description

46%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is concise and names a specific domain, but it omits any explicit 'Use when...' trigger clause and lacks the natural keywords (CVEs, audit, Snyk) that users would actually say. It is a passable but incomplete description.

Suggestions

Add an explicit trigger clause, e.g. 'Use when resolving vulnerabilities from Snyk or npm audit reports, or when the user mentions CVEs/CWEs in npm dependencies.'

Include natural user-facing terms like 'CVEs', 'CWEs', 'npm audit', and 'Snyk' to improve trigger term quality.

Enumerate the concrete fix actions (e.g. 'bump direct versions, add overrides for transitive deps, replace abandoned packages') to raise specificity.

Dimension	Reasoning	Score
Specificity	Names the domain ('npm dependency vulnerabilities') and one concrete action ('Resolve'), but the single verb is generic rather than enumerating specific fix actions like overriding versions or replacing packages.	3 / 5
Completeness	It states clearly what the skill does ('Resolve npm dependency vulnerabilities detected by security scans') but contains no 'Use when...' clause or equivalent explicit trigger guidance, so the 'when' is missing and completeness is capped at 3 per the rubric.	3 / 5
Trigger Term Quality	It uses the technical term 'security scans' and 'npm dependency vulnerabilities' but lacks natural phrases users actually say such as 'CVEs', 'audit', 'Snyk', or 'fix vulnerabilities'; only minimal natural trigger terms are present.	2 / 5
Distinctiveness Conflict Risk	The niche is fairly specific (npm dependency vulnerabilities from security scans) with limited overlap risk against unrelated skills, though it could collide with a more general security-fix skill.	4 / 5
	Total	12 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: redpanda-data/console
Path: frontend/.claude/skills/security-scan/SKILL.md
Commit: 2deda0a

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.