Tessl • The management layer for AI agent skills

SkillPublic

007

Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, incident response, and infrastructure security for any project.

Quality

65%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/007/SKILL.md

Quality

Content

53%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body works well as a lean router with a genuine one-level reference and appropriate content split across the bundle, but it relies almost entirely on the referenced guide for anything executable. Tightening the repetitive trigger bullets and adding a minimal quick-start (e.g., one scanner command and an execution-mode summary) would make it self-sufficient at the entry level.

Suggestions

Collapse the six 'When the user mentions X or related topics' bullets into a single trigger line listing the keywords, cutting templated filler.

Add a minimal quick-start block (e.g., 'Quick scan: python scripts/quick_scan.py --target <path>; full audit: python scripts/full_audit.py --target <path>') so the skill's executable entry point is visible without opening the guide.

Surface the five topic references and the scripts/ directory directly in SKILL.md with one-line descriptions, so navigation is one level deep instead of requiring two hops through the detailed guide.

Dimension	Reasoning	Score
Conciseness	Mostly efficient, but the six near-identical 'When the user mentions X or related topics' bullets and generic boilerplate like 'The task is unrelated to 007' are templated filler that should be collapsed into one line.	3 / 5
Actionability	The entry directive is concrete ('Read the detailed guide before executing this skill', focused vs. end-to-end loading strategy), but the body contains no commands, scanner invocations, or quick-start example — the executable content lives only in the guide and scripts/ is never surfaced.	3 / 5
Workflow Clarity	The written sequence (boundary → read guide → triggers → limitations) is coherent with an implicit 'stop and ask' checkpoint, but for a destructive-capable security skill the validation checkpoints are delegated entirely to the referenced guide rather than sequenced here.	3 / 5
Progressive Disclosure	A lean overview pointing to one clearly signaled real file (references/detailed-guide.md) with a load strategy; the guide in turn indexes all topic references and documents the scripts. Minor gap: sibling references and scripts/ are two hops from SKILL.md rather than surfaced directly.	4 / 5
	Total	13 / 20 Passed

Description

62%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A fairly strong capability list with good domain keywords, undermined by a completely missing 'when to use' clause and broad phrases ('code review', 'for any project') that create overlap with adjacent skills. Adding explicit trigger guidance and pentest/compliance synonyms would lift it substantially.

Suggestions

Append an explicit trigger clause such as: 'Use when the user asks for a security audit, pentest, threat model, OWASP review, hardening, or incident response, or mentions STRIDE/PASTA.'

Add missing natural synonyms users would actually say: 'pentest', 'penetration testing', 'vulnerability scan', 'security review', 'LGPD/GDPR compliance'.

Narrow the broad tail of the description ('code review', 'infrastructure security for any project') or tie it explicitly to the security context (e.g., 'security-focused code review') to reduce conflict with general code-review and DevOps skills.

Dimension	Reasoning	Score
Specificity	Lists several concrete capability areas ('security audit', 'hardening', 'threat modeling (STRIDE/PASTA)', 'OWASP checks', 'incident response') with named methodologies, but they are domain labels rather than verb-anchored actions and coverage has gaps (no dependency scanning, secrets detection, or compliance checks).	4 / 5
Completeness	The 'what' is clear and specific, but there is no 'Use when...' clause or equivalent explicit trigger guidance, which caps completeness at 3 per the rubric guidelines.	3 / 5
Trigger Term Quality	Includes natural terms users would say ('security audit', 'threat model', 'STRIDE', 'OWASP', 'incident response', 'hardening'), but misses common synonyms like 'pentest', 'penetration testing', 'vulnerability scan', and 'security review'.	4 / 5
Distinctiveness Conflict Risk	'code review' and 'infrastructure security for any project' overlap with general code-review and DevOps skills, while the overall security-audit framing is otherwise identifiable — somewhat specific but with real overlap risk.	3 / 5
	Total	14 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: sickn33/agentic-awesome-skills
Path: skills/007/SKILL.md
Revision: 55d9399

Reviewed: 15 days ago

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.

007

Table of Contents

Is this your skill?