static-bug-detector
Identifies bugs through static code analysis (null dereferences, type mismatches, control flow issues) without executing the program. Use when scanning code for defects before running tests, when the user asks for static analysis, or when integrating with CI for defect detection.
Install with Tessl CLI
npx tessl i github:santosomar/general-secure-coding-agent-skills --skill static-bug-detector100
Quality
100%
Does it follow best practices?
Impact
Pending
No eval scenarios have been run
Discovery
100%Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.
This is a well-crafted skill description that excels across all dimensions. It provides specific bug types as concrete examples, includes natural trigger terms users would actually say, has an explicit 'Use when...' clause with multiple scenarios, and clearly distinguishes itself from related skills like testing or runtime debugging.
| Dimension | Reasoning | Score |
|---|---|---|
Specificity | Lists multiple specific concrete actions: 'null dereferences, type mismatches, control flow issues' as specific bug types, and 'static code analysis' as the method. Uses third person voice correctly ('Identifies bugs'). | 3 / 3 |
Completeness | Clearly answers both what ('Identifies bugs through static code analysis') AND when with explicit 'Use when...' clause covering three scenarios: before tests, user requests, and CI integration. | 3 / 3 |
Trigger Term Quality | Includes natural keywords users would say: 'bugs', 'static analysis', 'defects', 'CI', 'scanning code'. Covers both technical terms ('static code analysis') and common variations ('defects', 'bugs'). | 3 / 3 |
Distinctiveness Conflict Risk | Clear niche focusing specifically on static analysis without execution, distinct from runtime debugging, testing, or code review skills. The emphasis on 'without executing the program' and specific bug types creates clear boundaries. | 3 / 3 |
Total | 12 / 12 Passed |
Implementation
100%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
This is an excellent skill that efficiently teaches static bug detection with concrete, actionable guidance. The signal catalog table is particularly well-designed, pairing defect classes with both detection patterns and false-positive traps. The worked example demonstrates exactly what output should look like, and the 'Do not' section provides clear guardrails.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The skill is lean and efficient, presenting a comprehensive signal catalog and ranking heuristics without explaining basic concepts Claude already knows. Every section adds actionable value with no padding or unnecessary context. | 3 / 3 |
Actionability | Provides concrete guidance throughout: specific defect classes with exact patterns to look for, a worked Java example with actual code and finding output, explicit output format specifications, and clear suppression rules. The content is directly executable. | 3 / 3 |
Workflow Clarity | The workflow is clear: scan using signal catalog → rank by severity/confidence/reachability → apply FP suppression checks (3 explicit steps) → format output. The FP suppression section provides explicit validation checkpoints before reporting findings. | 3 / 3 |
Progressive Disclosure | Content is well-organized into logical sections (signal catalog, ranking, FP suppression, worked example, edge cases, do-nots, output format) with clear headers. For a skill of this scope, the structure is appropriate without needing external file references. | 3 / 3 |
Total | 12 / 12 Passed |
Validation
100%Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.
Validation — 11 / 11 Passed
Validation for skill structure
No warnings or errors.
- Reviewed
Table of Contents
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.