CtrlK
BlogDocsLog inGet started
Tessl Logo

snyk-fix

Complete security remediation workflow. Scans code for vulnerabilities using Snyk, fixes them, validates the fix, and optionally creates a PR. Supports both single-issue and batch mode for multiple vulnerabilities. Use this skill when: - User asks to fix security vulnerabilities - User mentions "snyk fix", "security fix", or "remediate vulnerabilities" - User wants to fix a specific CVE, Snyk ID, or vulnerability type (XSS, SQL injection, path traversal, etc.) - User wants to upgrade a vulnerable dependency - User asks to "fix all" vulnerabilities or "fix all high/critical" issues (batch mode)

64

Quality

77%

Does it follow best practices?

Impact

No eval scenarios have been run

SecuritybySnyk

Passed

No known issues

Optimize this skill with Tessl

npx tessl skill review --optimize ./command_directives/synchronous_remediation/skills/snyk-fix/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

55%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

This skill excels in actionability and workflow clarity — it provides a thorough, well-sequenced security remediation workflow with concrete tool calls, decision trees, validation loops, and error handling. However, it is severely over-engineered for a single SKILL.md file: at 500+ lines it consumes excessive context window tokens, includes information Claude already knows (common vulnerability types, basic package manager commands), and would benefit enormously from splitting into multiple referenced files for progressive disclosure.

Suggestions

Split the monolithic content into multiple files: a concise SKILL.md overview (~100 lines) with references to SCA_STRATEGY.md, BATCH_MODE.md, ERROR_HANDLING.md, and ADVISORY_TEMPLATES.md

Remove explanations of concepts Claude already knows: common vulnerability fix patterns (SQL injection → parameterized queries), basic package manager commands, and what CVEs/CWEs are

Consolidate the advisory and no-fix-available templates into a referenced TEMPLATES.md file rather than inlining full markdown templates

Compress the decision trees and tables — e.g., the breakability decision tree for Strategy A/B and Strategy C are nearly identical and could be unified into a single parameterized table

DimensionReasoningScore

Conciseness

This skill is extremely verbose at ~500+ lines. It over-specifies decision trees, fallback logic, and edge cases that Claude could infer. Many sections (e.g., explaining what SQL injection or XSS are, listing common install commands Claude already knows, the full advisory template) add significant token cost without proportional value. The semver analysis table and multiple redundant constraint restatements further bloat the content.

1 / 3

Actionability

The skill provides highly concrete, executable guidance throughout: specific MCP tool names with parameters, exact git commands, specific decision trees with clear conditions and outcomes, concrete output templates, and precise error handling actions. Every phase has actionable steps rather than vague descriptions.

3 / 3

Workflow Clarity

The multi-step workflow is exceptionally well-sequenced with explicit phases, numbered steps, and clear validation checkpoints (Phase 5 re-scan, test running, linting). Feedback loops are present (max 3 attempts per instance, rollback triggers, fix-then-revalidate cycles). The batch mode includes user confirmation gates before proceeding. Error recovery paths are explicit.

3 / 3

Progressive Disclosure

The entire skill is a monolithic wall of text with no bundle files or external references. Content that could be split into separate files (SCA strategy details, advisory templates, error handling reference, batch mode specifics) is all inline. There are no references to supporting documents, and the sheer length makes navigation difficult despite having headers.

1 / 3

Total

8

/

12

Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

This is a strong skill description that clearly articulates what the skill does (scan, fix, validate, PR creation) and when to use it (with a detailed bulleted list of trigger scenarios). It uses third-person voice, includes natural user-facing trigger terms, and is specific enough to be clearly distinguishable from other skills.

DimensionReasoningScore

Specificity

Lists multiple specific concrete actions: scans code for vulnerabilities using Snyk, fixes them, validates the fix, creates a PR. Also specifies single-issue and batch mode capabilities.

3 / 3

Completeness

Clearly answers both 'what' (scans, fixes, validates, creates PR, supports single and batch mode) and 'when' with an explicit 'Use this skill when:' clause listing five specific trigger scenarios.

3 / 3

Trigger Term Quality

Excellent coverage of natural trigger terms users would say: 'fix security vulnerabilities', 'snyk fix', 'security fix', 'remediate vulnerabilities', 'CVE', 'Snyk ID', 'XSS', 'SQL injection', 'path traversal', 'upgrade a vulnerable dependency', 'fix all', 'fix all high/critical'.

3 / 3

Distinctiveness Conflict Risk

Clearly scoped to Snyk-based security vulnerability remediation with distinct triggers like 'snyk fix', 'CVE', 'Snyk ID', and specific vulnerability types. Unlikely to conflict with general code review or other non-security skills.

3 / 3

Total

12

/

12

Passed

Validation

90%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation10 / 11 Passed

Validation for skill structure

CriteriaDescriptionResult

skill_md_line_count

SKILL.md is long (532 lines); consider splitting into references/ and linking

Warning

Total

10

/

11

Passed

Repository
snyk/studio-recipes
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.