CtrlK
BlogDocsLog inGet started
Tessl Logo

audit-prep-assistant

Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes dead code, ensures accessibility, and generates documentation (flowcharts, user stories, inline comments). Use when preparing your own codebase to be audited by someone else, getting a repository review-ready before an external security review, deciding what to fix before auditors start, or asking what assessors need from a project. For understanding unfamiliar code you are about to audit, use audit-context-building instead.

64

Quality

75%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./plugins/building-secure-contracts/skills/audit-prep-assistant/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

50%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a well-structured, task-specific guide but is held to mid-range scores by redundant restatements of the same steps, missing concrete commands for several steps, and absence of explicit validation gates and file-split progressive disclosure.

Suggestions

Consolidate the step list into one place and drop or sharply prune the redundant restatements in 'How I Work', 'What You'll Get', and 'Timeline' to remove verbosity.

Add explicit validation checkpoints after each destructive/batch step (e.g., 'After running slither, confirm 0 High/Medium before proceeding') and replace the '# CodeQL and Semgrep checks' comment with actual commands.

Move the large Example Output block and the documentation checklist into separate reference files (e.g., references/example-package.md) and link to them from SKILL.md to improve progressive disclosure.

DimensionReasoningScore

Conciseness

The four-step process is restated four times — in 'The Preparation Process', 'How I Work', 'What You'll Get', and 'Timeline' — and the inlined Example Output block is large, so the body is mostly efficient but carries clear redundancy that could be tightened.

3 / 5

Actionability

A few commands are copy-pasteable ('slither . --exclude-dependencies', 'dylint --all', 'golangci-lint run'), but coverage, dead-code, and documentation steps are high-level directives with no tool/command, and 'For Go/Rust/C++: # CodeQL and Semgrep checks' is a non-executable comment placeholder.

3 / 5

Workflow Clarity

The four steps are clearly sequenced with a final checklist, but there are no explicit per-step validation gates (validate-then-proceed loops), and the destructive/batch operations (dead-code removal, batch static analysis) trigger the workflow-clarity cap at 3.

3 / 5

Progressive Disclosure

Sections are well-organized with clear headers, but everything is inlined in a ~250-line SKILL.md with only a brand SVG in assets/ and no references/ or scripts/ — content that would benefit from being split (the full example package, the doc checklist) is kept inline.

3 / 5

Total

12

/

20

Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is exemplary: third-person voice, comprehensive concrete capabilities, explicit multi-trigger 'Use when' guidance, and explicit disambiguation from a related skill. It satisfies every dimension at the top anchor.

DimensionReasoningScore

Specificity

Lists multiple concrete actions ('set review goals, runs static analysis tools, increases test coverage, removes dead code, ensures accessibility, and generates documentation (flowcharts, user stories, inline comments)') with comprehensive coverage of what the skill does.

5 / 5

Completeness

Explicitly answers both 'what' (the enumerated capabilities) and 'when' via a concrete 'Use when...' clause with several specific trigger scenarios, matching the 5-anchor.

5 / 5

Trigger Term Quality

Covers natural trigger phrases and synonyms a user would actually say — 'audited by someone else', 'review-ready before an external security review', 'what to fix before auditors start', 'what assessors need' — across audit/security review/auditor/assessor variants.

5 / 5

Distinctiveness Conflict Risk

It carves a clear audit-prep niche and explicitly disambiguates from a sibling ('For understanding unfamiliar code you are about to audit, use audit-context-building instead.'), giving minimal conflict risk.

5 / 5

Total

20

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
trailofbits/skills
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.