Content
62%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
This is a well-structured skill with a clear five-phase workflow and good verification steps, but it suffers from being overly long for a single file—particularly the remediation examples which Claude largely already knows how to produce. The scan tool invocations lack executable specificity, using pseudocode rather than concrete tool call syntax. The content would benefit from splitting remediation examples into separate files and tightening the core scanning instructions.
Suggestions
Show the actual tool call syntax or CLI command for snyk_iac_scan rather than pseudocode blocks like 'Run snyk_iac_scan with: - path: ...' to make the scanning steps truly executable.
Move the platform-specific remediation examples (Terraform, Kubernetes, CloudFormation fixes) into separate referenced files to reduce the main skill's token footprint and improve progressive disclosure.
Remove or significantly trim content Claude already knows, such as the generic severity definitions table, the 'Core Principle' tagline, and the supported file types table (Claude can detect these from file contents).
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The skill is reasonably well-structured but includes some content Claude already knows (e.g., the supported IaC formats table is largely detectable from file contents, the severity assessment table is generic knowledge, and the 'Core Principle' tagline adds no value). The remediation examples are extensive and could be trimmed since Claude knows how to write secure Terraform/K8s/CloudFormation configs. However, the examples do serve as concrete reference patterns, so they're not purely wasteful. | 2 / 3 |
Actionability | The scan invocations use pseudocode-style blocks ('Run snyk_iac_scan with: - path: ...') rather than showing actual tool call syntax or CLI commands, making them not truly copy-paste ready. The remediation code examples are concrete and executable, which is good, but the core scanning workflow—the primary purpose of the skill—lacks executable specificity around the tool interface. | 2 / 3 |
Workflow Clarity | The five-phase workflow (Discovery → Scan → Analyze → Remediate → Verify) is clearly sequenced with explicit validation in Phase 5 including re-scanning after fixes and a before/after comparison table. The feedback loop of scan → fix → re-scan is well-articulated, and error handling is provided in a dedicated section. | 3 / 3 |
Progressive Disclosure | The content is a single monolithic file at ~250+ lines with no references to supporting files. The extensive remediation examples for Terraform, Kubernetes, and CloudFormation could be split into separate reference files. For a skill of this complexity and length, inline everything without any external references results in a large document that could benefit from better content splitting. | 2 / 3 |
Total | 9 / 12 Passed |