vulnerability-scanning

Automated security scanning for dependencies, code, containers with Trivy, Snyk, npm audit. Use for CI/CD security gates, pre-deployment audits, compliance requirements, or encountering CVE detection, outdated packages, license compliance, SBOM generation errors.

Quality

81%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Quality

Content

76%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable and concise, dominated by copy-paste-ready commands and a complete CI workflow plus working scanner code. Its main weakness is workflow clarity: it reads as a tool catalog rather than a sequenced process, and batch scanning lacks explicit validation/feedback checkpoints that would lift it above 3.

Suggestions

Add a short "Workflow" section sequencing the scanning process (e.g. scan dependencies -> scan containers -> review findings -> fail/suppress) with an explicit verification/gate checkpoint so batch operations have validation.

Add a brief validate->fix->retry feedback loop for fixing or suppressing high/critical findings before re-running scans.

Trim redundancy: the one-line intro and the Tools list overlap the description and the inline commands; consolidate to improve token efficiency.

Dimension	Reasoning	Score
Conciseness	The body is largely lean executable code and command blocks with minimal prose, and the JS error-handling comment earns its place by explaining a real edge case; it stops short of 5 only because the intro line and the Tools list lightly restate information already in the description and code.	4 / 5
Actionability	Fully executable, copy-paste-ready examples across every section (npm audit, snyk, trivy, bandit, a complete GitHub Actions workflow, and a working Node.js scanner), covering the common cases concretely.	5 / 5
Workflow Clarity	The skill is mostly a reference catalog of scan commands rather than a sequenced workflow; the CI YAML provides a gated sequence (exit-code: '1') but there are no validate->fix->retry feedback loops, and batch scanning lacks explicit verification checkpoints, capping the score at 3.	3 / 5
Progressive Disclosure	Well-organized with clear ## section headers and no nested references, with content appropriately inlined for a self-contained reference skill; it is not a 5 only because there is no explicit overview/navigation signaling and the body slightly exceeds the simple-skill threshold where structure alone earns a 5.	4 / 5
	Total	16 / 20 Passed

Description

87%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is strong: it pairs a concrete what (scanning dependencies, code, and containers with named tools) with an explicit "Use for" clause listing natural trigger phrases, yielding high completeness and distinctiveness. Minor gaps in action breadth and a few missing synonyms keep specificity and trigger-term quality at 4 rather than 5.

Dimension	Reasoning	Score
Specificity	Names several concrete scan targets ("dependencies, code, containers") paired with specific tools ("Trivy, Snyk, npm audit"), listing several specific actions with only minor gaps (no remediation/reporting). It sits above the 3 anchor because it enumerates multiple concrete actions and tools, but below 5 since the core verb is just "scanning" applied across domains.	4 / 5
Completeness	It explicitly answers both what ("Automated security scanning for dependencies, code, containers with Trivy, Snyk, npm audit") and when via a concrete "Use for..." clause with multiple trigger phrases, matching the 5 anchor.	5 / 5
Trigger Term Quality	Good natural keyword coverage ("CI/CD security gates", "pre-deployment audits", "CVE detection", "outdated packages", "license compliance", "SBOM generation"), but a few common variations (e.g. "vulnerability scan", "dependency check", file extensions) are missing, so it is not comprehensive enough for a 5.	4 / 5
Distinctiveness Conflict Risk	Clear niche (security vulnerability/SCA scanning) with distinct triggers (CVE, SBOM, license compliance, security gates) and minimal overlap risk with unrelated skills.	5 / 5
	Total	18 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: secondsky/claude-skills
Path: plugins/vulnerability-scanning/skills/vulnerability-scanning/SKILL.md
Commit: ad16332

Reviewed: 12 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.