container-security
Comprehensive container image security scanning and remediation. Analyzes Docker images for OS package vulnerabilities, application dependencies, and Dockerfile best practices. Use when: - User asks to scan a Docker image or container - User mentions "container security" or "image vulnerabilities" - User wants to secure a Dockerfile - User asks about base image security - Agent is working with Docker, Kubernetes, or container deployments
60
70%
Does it follow best practices?
Impact
—
No eval scenarios have been run
Advisory
Suggest reviewing before use
Optimize this skill with Tessl
npx tessl skill review --optimize ./command_directives/synchronous_remediation/skills/container-security/SKILL.mdQuality
Discovery
100%Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.
This is a strong skill description that clearly communicates its purpose, lists concrete capabilities, and provides explicit trigger conditions. It covers natural user language well with terms like 'Docker image', 'container security', and 'Dockerfile'. The structured 'Use when' list with five distinct scenarios makes it easy for Claude to determine when to select this skill.
| Dimension | Reasoning | Score |
|---|---|---|
Specificity | Lists multiple specific concrete actions: 'Analyzes Docker images for OS package vulnerabilities, application dependencies, and Dockerfile best practices.' This clearly describes what the skill does with concrete, domain-specific capabilities. | 3 / 3 |
Completeness | Clearly answers both 'what' (analyzes Docker images for OS package vulnerabilities, application dependencies, Dockerfile best practices) and 'when' with an explicit 'Use when:' clause listing five specific trigger scenarios. | 3 / 3 |
Trigger Term Quality | Excellent coverage of natural terms users would say: 'scan a Docker image', 'container security', 'image vulnerabilities', 'Dockerfile', 'base image security', 'Docker', 'Kubernetes', 'container deployments'. These are all terms users would naturally use when needing this skill. | 3 / 3 |
Distinctiveness Conflict Risk | Highly distinctive niche focused specifically on container image security scanning. The triggers are specific to Docker/container security and unlikely to conflict with general code security, dependency management, or other DevOps skills. | 3 / 3 |
Total | 12 / 12 Passed |
Implementation
39%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The skill has a well-structured multi-phase workflow with good validation/verification steps and concrete tool invocations, but it is far too verbose for a SKILL.md. It explains many concepts Claude already understands (Docker basics, vulnerability categories, what base images are) and repeats information across sections. The entire document should be significantly condensed with detailed reference material split into separate files.
Suggestions
Cut the content by at least 50%: remove explanations of concepts Claude already knows (what OS packages vs app deps are, what base images do), eliminate the redundant Common Scenarios section, and trim template placeholders to a single concise example.
Extract the Base Image Quick Reference table, Dockerfile Best Practices, and detailed remediation templates into separate referenced files (e.g., BASE_IMAGES.md, BEST_PRACTICES.md, REMEDIATION.md) to improve progressive disclosure.
Replace the Quick Start pseudocode with a single concrete, copy-paste-ready example showing the actual MCP tool call and a brief expected output.
Consolidate the End-to-End Example with the Phase descriptions — currently the same workflow is described twice in different formats.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The skill is extremely verbose at ~250+ lines. It over-explains concepts Claude already knows (e.g., what base images are, what OS packages vs app dependencies are, how Docker builds work). The phased structure repeats information across sections (e.g., remediation examples appear in Phase 4 and again in the End-to-End Example). The Common Scenarios section largely restates the workflow already described. Much of this could be cut by 60%+ without losing actionable content. | 1 / 3 |
Actionability | The skill provides concrete MCP tool invocations (mcp_snyk_snyk_container_scan with specific parameters) and executable Dockerfile snippets, which is good. However, much of the content is template/placeholder text (e.g., 'CVE-2024-XXXX', summary tables with X/Y/Z placeholders) rather than truly executable guidance. The Quick Start is pseudocode-level numbered steps rather than concrete commands. | 2 / 3 |
Workflow Clarity | The multi-phase workflow is clearly sequenced with explicit validation steps: scan → analyze → remediate → rebuild with --no-cache → re-scan → compare results. Phase 5 provides a proper feedback loop (rebuild, re-scan, compare before/after). The verification step with comparison table is a strong checkpoint pattern. | 3 / 3 |
Progressive Disclosure | This is a monolithic wall of text with no references to external files despite being well over 200 lines. The base image reference table, common scenarios, Dockerfile best practices, and detailed remediation templates could all be split into separate referenced files. There are no bundle files, yet the content clearly warrants decomposition for a skill of this size. | 1 / 3 |
Total | 7 / 12 Passed |
Validation
100%Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.
Validation — 11 / 11 Passed
Validation for skill structure
No warnings or errors.
- Repository
- snyk/studio-recipes
- Commit
786986d
- Reviewed
Table of Contents
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.