security-scanning-security-dependencies

You are a security expert specializing in dependency vulnerability analysis, SBOM generation, and supply chain security. Scan project dependencies across ecosystems to identify vulnerabilities, assess risks, and recommend remediation.

Quality

46%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/security-scanning-security-dependencies/SKILL.md

Quality

Content

35%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is well-structured with useful Use/Do-not-use framing, but it provides no executable guidance and relies on a referenced playbook file that is not present in the bundle, leaving it descriptive rather than actionable.

Suggestions

Replace the generic Instructions with concrete, executable guidance: name specific scanners (e.g. osv-scanner, trivy, grype, syft) and give copy-paste commands for scanning and SBOM generation.

Either add the missing resources/implementation-playbook.md with real examples or remove the broken references in the Instructions and Resources sections.

Add an explicit validation feedback loop (scan -> review findings -> remediate -> re-scan to confirm) for the release-impacting dependency changes flagged in the Safety section.

Dimension	Reasoning	Score
Conciseness	The opening paragraph and 'Context' section largely restate the frontmatter description, and 'modern 2024/2025 tools' is vague time-sensitive filler, but the Use/Do-not-use and Safety sections are reasonably tight.	2 / 3
Actionability	The Instructions are generic platitudes ('Clarify goals...', 'Apply relevant best practices and validate outcomes') with no concrete tools, commands, or code, and the only concrete pointer ('open resources/implementation-playbook.md') targets a file that does not exist.	1 / 3
Workflow Clarity	A loose sequence exists (clarify -> apply -> provide+verify) and the Safety section nods at validation, but there is no explicit validate->fix->retry checkpoint loop for release-impacting dependency changes.	2 / 3
Progressive Disclosure	Sections are well organized and the reference is only one level deep, but it points to resources/implementation-playbook.md which is absent, so the navigation pointer is broken.	2 / 3
	Total	7 / 12 Passed

Description

57%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description names a clear, distinctive niche and several concrete actions, but it is written in second-person voice and lacks an explicit 'Use when' trigger clause, capping both specificity and completeness.

Suggestions

Rewrite in third-person imperative voice (e.g. 'Scans project dependencies...') instead of 'You are a security expert...' to recover the specificity penalty.

Add an explicit trigger clause such as 'Use when auditing dependencies for vulnerabilities or license risks, generating SBOMs, or planning remediation for outdated or vulnerable packages.'

Include more natural user phrasing (e.g. 'CVEs', 'outdated packages', 'vulnerable packages', 'license compliance') to broaden trigger-term coverage.

Dimension	Reasoning	Score
Specificity	It lists multiple concrete actions ('Scan project dependencies... to identify vulnerabilities, assess risks, and recommend remediation', plus SBOM generation), which would merit a 3, but the opening 'You are a security expert...' is second-person voice, which the guidelines penalize by reducing specificity by one.	2 / 3
Completeness	It clearly states what the skill does, but there is no 'Use when...' clause or equivalent explicit trigger guidance, so completeness is capped at 2 per the guidelines.	2 / 3
Trigger Term Quality	It contains relevant keywords ('dependencies', 'vulnerabilities', 'SBOM', 'remediation', 'supply chain security') but omits common variations users would naturally say such as 'CVEs', 'outdated packages', 'vulnerable packages', or 'license'.	2 / 3
Distinctiveness Conflict Risk	The dependency-vulnerability / SBOM / supply-chain niche is specific with distinct triggers, making it unlikely to fire for the wrong skill.	3 / 3
	Total	9 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: rmyndharis/antigravity-skills
Path: skills/security-scanning-security-dependencies/SKILL.md
Commit: e63f7dd

Reviewed: 13 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.