CtrlK
BlogDocsLog inGet started
Tessl Logo

leaked-secrets

Use when reviewing client-side JavaScript, HTML source, or git history for exposed credentials, API keys, or tokens.

62

Quality

73%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

High

Do not use without reviewing

Fix and improve this skill with Tessl

tessl review fix ./skills/leaked-secrets/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

57%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a clean, well-structured overview with good progressive disclosure pointing to a real reference file, but it leans on the reference for executable code and lacks an explicit validation checkpoint for the destructive rotation/history-rewriting steps. Conciseness is slightly weakened by duplicated guidance across sections.

Suggestions

Add an explicit validate-and-confirm step to the Fix workflow (e.g., confirm rotation completed and the old credential is revoked before rewriting git history) to lift workflow clarity.

Move or deduplicate the Quick Reference bullets that reappear in rule.md so the overview does not repeat detail already in the reference.

Include at least one complete, copy-paste-ready code snippet inline (e.g., a git-secrets pre-commit hook) rather than only naming patterns, to raise actionability.

DimensionReasoningScore

Conciseness

The overview is mostly efficient and free of padded explanations of concepts Claude already knows, but sections like "## Explain" and "## Code Review" restate guidance and the Quick Reference duplicates detail in rule.md, so it could be tightened.

2 / 3

Actionability

The body provides concrete commands (e.g., "git log -S 'keyword'"), named secret patterns (sk_, pk_, AIza, ghp_, AKIA), and tool names, but the executable code examples are deferred to rule.md and the body's own snippets are patterns rather than copy-paste ready code.

2 / 3

Workflow Clarity

Check/Fix/Explain/Code Review gives a light sequence, but for a skill involving credential rotation and git-history rewriting there is no explicit validate-then-proceed checkpoint, and the rubric caps such risky operations at 2 when validation is missing.

2 / 3

Progressive Disclosure

The SKILL.md is a concise overview under 50 lines that clearly signals a single one-level-deep reference to references/rule.md (a verified real file), with well-organized sections and easy navigation.

3 / 3

Total

9

/

12

Passed

Description

90%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A concise, well-triggered description that clearly states when to use the skill and what it targets, with natural trigger terms and low conflict risk. The only weak spot is specificity, since it relies on the single action "reviewing" rather than enumerating multiple concrete actions.

Suggestions

Replace or expand the single verb "reviewing" with two or three concrete actions (e.g., "Scan... for, identify, and rotate exposed secrets") to lift specificity toward the top anchor.

DimensionReasoningScore

Specificity

"reviewing client-side JavaScript, HTML source, or git history" names a concrete domain and several artifacts, but the single verb "reviewing" does not enumerate multiple specific concrete actions, matching the anchor that names domain and some actions but is not comprehensive.

2 / 3

Completeness

The description explicitly answers both what (reviewing for exposed credentials/keys/tokens) and when (the leading "Use when reviewing..." trigger clause), satisfying the top anchor.

3 / 3

Trigger Term Quality

Phrases like "exposed credentials, API keys, or tokens" alongside "client-side JavaScript, HTML source, or git history" are natural terms a user would actually say, giving good coverage of relevant trigger keywords.

3 / 3

Distinctiveness Conflict Risk

The client-side-frontend-secret-exposure and git-history niche is narrow and tied to distinct triggers, making it unlikely to fire for unrelated skills.

3 / 3

Total

11

/

12

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

Total

15

/

16

Passed

Repository
thedaviddias/Front-End-Checklist
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.