vulnerability-scanner

Advanced vulnerability analysis principles. OWASP 2025, Supply Chain Security, attack surface mapping, risk prioritization.

Quality

55%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./.agents/skills/vulnerability-scanner/SKILL.md

Quality

Content

50%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is well-organized into themed sections with concrete pattern indicators and a clear scanning methodology, but it inlines concepts Claude already knows, lacks explicit validation checkpoints, and ships a broken reference plus an orphaned script.

Suggestions

Fix the broken reference: either add the missing checklists.md file or remove the [checklists.md](checklists.md) link from the reference table.

Either reference scripts/dependency_analyzer.py in the body or remove it from the bundle so the scripts table matches the actual files.

Trim well-known conceptual padding (basic Zero Trust / Least Privilege definitions, cloud shared-responsibility table) and add an explicit validation/feedback step to the scanning methodology.

Dimension	Reasoning	Score
Conciseness	Content is packed into compact tables, but substantial space is spent on concepts Claude already knows (Zero Trust, Least Privilege, Defense in Depth, the cloud shared-responsibility model), so it could be tightened.	3 / 5
Actionability	Concrete grep targets exist (eval(), pickle.loads(), "SELECT * FROM " + user_input, secret prefixes, CVSS/EPSS thresholds) plus one script invocation, but there is no end-to-end executable scanning workflow tying them together.	3 / 5
Workflow Clarity	The 4-phase methodology (Reconnaissance, Discovery, Analysis, Reporting) gives a clear sequence, but validation checkpoints and feedback loops are absent or only implicit.	3 / 5
Progressive Disclosure	Section headers and a scripts table provide structure, but the body references checklists.md which does not exist in the bundle, and scripts/dependency_analyzer.py is present but unreferenced; most reference-worthy content (OWASP detail, checklists) is inlined.	3 / 5
	Total	12 / 20 Passed

Description

61%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description names a clear, distinct security niche with a couple of concrete activity phrases and good natural keywords, but it omits an explicit 'Use when' trigger clause in the description field itself and leans on topic nouns rather than concrete actions.

Suggestions

Add an explicit 'Use when ...' trigger clause to the description field (e.g., 'Use when scanning for vulnerabilities, checking OWASP 2025 compliance, or auditing supply chain security') rather than relying on the separate when_to_use field.

Replace topic nouns with concrete actions (e.g., 'Scans code for injection and crypto flaws, maps the attack surface, prioritizes findings by CVSS/EPSS') to lift specificity.

Include common user synonyms such as CVE, pentest, and 'security scan' to broaden trigger coverage.

Dimension	Reasoning	Score
Specificity	Names the domain ('Advanced vulnerability analysis principles') plus a couple of concrete activity phrases ('attack surface mapping', 'risk prioritization'), but offers no concrete scanning actions and is not comprehensive.	3 / 5
Completeness	A clear 'what' is stated, but the description field itself contains no 'when' / 'Use when' trigger clause (that guidance lives in the separate when_to_use field), which caps completeness at 3 per the rubric guideline.	3 / 5
Trigger Term Quality	Natural terms a user would say are present ('vulnerability', 'OWASP 2025', 'Supply Chain Security'), but common synonyms like CVE, pentest, or 'security scan' are missing.	4 / 5
Distinctiveness Conflict Risk	The vulnerability-analysis / OWASP niche is clearly distinct, but the broad 'security' framing and absence of trigger phrases leave minor overlap risk with general security skills.	4 / 5
	Total	14 / 20 Passed

Validation

81%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 13 / 16 Passed

Validation for skill structure

Criteria	Description	Result
allowed_tools_field	'allowed-tools' contains unusual tool name(s)	Warning
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning
relative_links	Relative link issues: 1 missing	Warning

	Total	13 / 16 Passed

Repository: vudovn/ag-kit
Path: .agents/skills/vulnerability-scanner/SKILL.md
Commit: 211561c

Reviewed: 8 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.