Name: snyk-fix
Rating: 72 (1 reviews)
Author: snyk

snyk-fix

Complete security remediation workflow. Scans code for vulnerabilities using Snyk, fixes them, validates the fix, and optionally creates a PR. Supports both single-issue and batch mode for multiple vulnerabilities. Use this skill when: - User asks to fix security vulnerabilities - User mentions "snyk fix", "security fix", or "remediate vulnerabilities" - User wants to fix a specific CVE, Snyk ID, or vulnerability type (XSS, SQL injection, path traversal, etc.) - User wants to upgrade a vulnerable dependency - User asks to "fix all" vulnerabilities or "fix all high/critical" issues (batch mode)

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

77%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a thorough, highly actionable remediation workflow with strong sequencing and validation, but it is monolithic and somewhat redundant. Splitting reference material into bundle files and de-duplicating the Constraints/Error-Handling sections would raise the two middle dimensions.

Suggestions

Move the large inline reference material (SCA Strategy A/B/C decision trees, the No-Fix/Advisory report templates, and the package-manager command table) into files under references/ and link to them from SKILL.md to improve progressive disclosure.

De-duplicate the Constraints and Error Handling sections, which restate rules already specified in Phases 4 and 5, to tighten conciseness.

Consider a short overview/quick-start section at the top so the detailed phased walkthrough reads as progressive detail rather than a wall of process.

Dimension	Reasoning	Score
Conciseness	Mostly efficient and skill-specific (Snyk decision trees, breakability handling), but the Constraints and Error Handling sections restate phase content and the ~510-line body could be tightened; not the lean every-token-earns-its-place anchor at 3.	2 / 3
Actionability	Provides fully executable, copy-paste-ready commands ("git checkout -b fix/security-<identifier>", "gh pr create --title ... --base main", "npm install <pkg>@<version>", "mvn dependency:resolve") and concrete tool invocations with parameters, matching the highest anchor.	3 / 3
Workflow Clarity	Clear phased sequence (Parse -> Scan -> Analyze -> Fix -> Validate -> Summary -> PR) with explicit validation checkpoints (re-scan, tests, lint), retry/rollback feedback loops, batch-mode confirmation, and completion checklists; batch/destructive ops have validation, so not capped at 2.	3 / 3
Progressive Disclosure	Well-organized into phases but it is a single monolithic ~510-line file with no bundle files or external references, and reference-like content (SCA strategy decision trees, report templates, install-command table) is inline rather than split out; not the one-level-deep-references anchor at 3.	2 / 3
	Total	10 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is strong: third-person voice, concrete actions, an explicit "Use this skill when" trigger list, and a distinct Snyk-scoped niche. It cleanly satisfies every dimension at the top anchor with no fluff or over-claims.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions - "Scans code for vulnerabilities using Snyk, fixes them, validates the fix, and optionally creates a PR" plus "Supports both single-issue and batch mode" - matching the highest anchor rather than the partial-action anchor at 2.	3 / 3
Completeness	Explicitly states both what ("Complete security remediation workflow... Scans... fixes... validates... creates a PR") and when via a literal "Use this skill when:" block with five bullet triggers, satisfying the explicit-both-what-and-when anchor.	3 / 3
Trigger Term Quality	Covers natural phrasings users would say - "snyk fix", "security fix", "remediate vulnerabilities", "fix all high/critical", and specific CVE/Snyk ID/vuln-type references - rather than the jargon-only anchor at 1 or the partial-coverage anchor at 2.	3 / 3
Distinctiveness Conflict Risk	Occupies a clear Snyk-specific security-remediation niche with triggers tied to Snyk/CVE identifiers, making conflicts with unrelated skills unlikely rather than the overlapping anchor at 2.	3 / 3
	Total	12 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (532 lines); consider splitting into references/ and linking	Warning

	Total	15 / 16 Passed

Repository: snyk/studio-recipes
Path: command_directives/synchronous_remediation/skills/snyk-fix/SKILL.md
Commit: 80e11c7

Reviewed: about 7 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.