CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

audit-trail-test-author

Use when audit logs need tests for HIPAA, PCI DSS, SOC 2, GDPR or another framework: the required events (logins, privilege changes, data access, admin actions, exports), structured log format, tamper-evident hash chains, immutability and retention, and replaying logs for forensics.

Quality

85%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

The canonical home for this skill is testland/audit-trail-test-author

SKILL.md
Quality
Evals
Security

Quality

Content

75%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, actionable recipe with concrete test patterns for every compliance requirement and a clear eight-step sequence culminating in a checklist. The main gaps are minor: an incomplete Step 6 example, absent error-recovery guidance, and inline per-framework detail that could be offloaded to reference files.

Suggestions

Complete the Step 6 forensic-replay example — the gap-detection loop computes `gap` but never asserts, and the comment 'Annotate: this would be domain-specific' leaves the test unfinished.

Add brief error-recovery guidance for the trickiest steps (e.g. what to investigate when the hash-chain or central-aggregation test fails), which would raise workflow clarity to the top anchor.

Move the per-framework requirement/retention tables into a reference file to shorten SKILL.md toward an overview and improve token efficiency, since the body exceeds typical overview length.

DimensionReasoningScore

Conciseness

The body is dense and efficient — tables and one focused test example per step — with only minor trimmable material: the Step 8 checklist repeats the step titles, "This is a build-an-X workflow" is stated twice, and the "Different from a generic logging skill" line is meta-commentary rather than instruction.

4 / 5

Actionability

Nine concrete pytest-style tests (structure validation, hash chain, KMS-signed batch, append-only, retention, PAN/PHI redaction, forensic replay, central aggregation) provide mostly executable guidance, but they assume undefined fixtures like `user.access_phi` and `kms.verify_signature`, and the Step 6 gap loop computes `gap` without asserting anything.

4 / 5

Workflow Clarity

Steps 1–8 are clearly sequenced and close with an explicit end-to-end checklist plus an anti-patterns table mapping failures to fixes, but there are no error-recovery feedback loops (e.g. what to check when the hash-chain or aggregation test fails).

4 / 5

Progressive Disclosure

No bundle files exist, so this is scored on the single-file structure: sections are well-organized and the References section is clearly signaled, but all per-framework detail tables and nine code blocks are inlined in a ~280-line file where some material could be split into reference files.

4 / 5

Total

16

/

20

Passed

Description

88%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description that explicitly covers both what the skill does and when to use it, with concrete framework names and specific capability areas. Its only weaknesses are a few missing natural synonyms and slight overlap risk with sibling compliance-framework skills.

DimensionReasoningScore

Specificity

The description enumerates concrete capability areas — "the required events (logins, privilege changes, data access, admin actions, exports), structured log format, tamper-evident hash chains, immutability and retention, and replaying logs for forensics" — giving comprehensive, specific coverage with no vague filler.

5 / 5

Completeness

Both parts are explicit: "Use when audit logs need tests for HIPAA, PCI DSS, SOC 2, GDPR or another framework" answers when with concrete triggers, and the enumerated list of test areas answers what, matching the strongest anchor.

5 / 5

Trigger Term Quality

Natural terms users would say are present ("audit logs", "tests", "HIPAA", "PCI DSS", "SOC 2", "GDPR", "forensics", "retention"), but common synonyms such as "audit trail", "compliance", and "log review" are missing.

4 / 5

Distinctiveness Conflict Risk

The audit-log testing niche is distinct with framework-specific triggers, but there is minor overlap risk with closely related sibling skills the body itself references (e.g. `hipaa-test-patterns`, `pci-dss-control-test-author`), and "or another framework" slightly widens the trigger.

4 / 5

Total

18

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

testland/qa

Path

plugins/qa-compliance/skills/audit-trail-test-author/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.