CtrlK
BlogDocsLog inGet started
Tessl Logo

sast-analysis

Perform codebase analysis and architecture mapping as the first phase of a security assessment. Explores the tech stack, frameworks, entry points, data flows, and trust boundaries. Outputs sast/architecture.md. Run this before any vulnerability detection skill. Use when asked to analyze a codebase for security or when sast/architecture.md does not yet exist.

69

Quality

83%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

The canonical home for this skill is sast-analysis in utkusen/sast-skills

SKILL.md
Quality
Evals
Security

Quality

Content

75%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-organized, actionable reconnaissance skill with a clear two-phase workflow and a precise output template. It stays lean and assumes Claude's competence, with only minor conciseness and actionability gaps.

Suggestions

Tighten the opening narrative ('You are performing the first phase... This is pure reconnaissance.') into a single directive line to recover tokens.

Add 1-2 concrete exploration commands or search patterns (e.g., grep for auth middleware, route decorators) to make Phase 1 more executable.

Consider a brief self-check step at the end (e.g., 'verify architecture.md lists every entry point found in Phase 1') to add an explicit validation checkpoint.

DimensionReasoningScore

Conciseness

The body is efficient and assumes Claude's competence, listing concrete recon targets without explaining basic concepts, though the narrative framing ('You are performing the first phase...', 'This is pure reconnaissance') could be trimmed slightly.

4 / 5

Actionability

It gives concrete, specific guidance — named file types (package.json, requirements.txt, go.mod), distinct phases, and a complete markdown output template — though it provides no executable exploration commands, leaving minor gaps for an instruction-only skill.

4 / 5

Workflow Clarity

The two-phase sequence (Technology Reconnaissance, then Architecture Mapping) with a confirmation checkpoint ('Then drill into source code to confirm findings') is clear and well-ordered; the destructive/batch cap does not apply since the only output is a single documentation file.

4 / 5

Progressive Disclosure

The skill is self-contained with no bundle files and is organized into clearly labeled phases and an output template; structure is good though the inline template and reminder list could in principle be split out.

4 / 5

Total

16

/

20

Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that clearly scopes the skill as reconnaissance and gives concrete actions plus explicit use-when triggers. It is comprehensive on what and when, with only minor gaps in trigger-term synonyms.

DimensionReasoningScore

Specificity

The description lists multiple concrete actions ('Perform codebase analysis and architecture mapping', 'Explores the tech stack, frameworks, entry points, data flows, and trust boundaries', 'Outputs sast/architecture.md') with comprehensive coverage of the reconnaissance task.

5 / 5

Completeness

It explicitly answers both what ('Perform codebase analysis and architecture mapping... Outputs sast/architecture.md') and when ('Run this before any vulnerability detection skill. Use when asked to analyze a codebase for security or when sast/architecture.md does not yet exist') with concrete trigger phrases.

5 / 5

Trigger Term Quality

It includes natural phrases users would say ('analyze a codebase for security', 'architecture mapping', 'tech stack') but lacks synonyms and file/extension-based triggers, so it falls just below comprehensive coverage.

4 / 5

Distinctiveness Conflict Risk

It carves a clear niche as the first reconnaissance phase of a security assessment and explicitly distinguishes itself from later vulnerability detection skills, minimizing conflict risk.

5 / 5

Total

19

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
utkusen/sast-skills
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.