vulnerability-scanner

Advanced vulnerability analysis principles. OWASP 2025, Supply Chain Security, attack surface mapping, risk prioritization.

Quality

50%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./.agents/skills/vulnerability-scanner/SKILL.md

Quality

Content

50%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a dense, well-structured reference with concrete patterns, thresholds, and a callable validation script, but it pads in well-known concepts, lacks explicit validation checkpoints in its scanning workflow, and ships a broken reference plus an unreferenced script. Most dimensions land at 2.

Suggestions

Remove or compress concept restatements Claude already knows (Security Mindset principles, cloud Shared Responsibility table) to tighten conciseness.

Weave an explicit validation checkpoint into the scanning methodology, e.g. after Analysis run `python scripts/security_scan.py` and only report findings that pass false-positive elimination.

Create the missing checklists.md (or fix the link) and either reference scripts/dependency_analyzer.py from the body or document why it is bundled.

Dimension	Reasoning	Score
Conciseness	The body is mostly lean, table-driven reference material (OWASP table, pattern tables, decision trees), but sections like "Security Expert Mindset" (Assume Breach, Zero Trust, Least Privilege) and the cloud "Shared Responsibility" table restate concepts Claude already knows, so it is not the every-token-earns-its-place level 3.	2 / 3
Actionability	It provides concrete grep-able indicators (`"SELECT * FROM " + user_input`, `eval()`, `api_key`, `AWS_` prefixes), specific thresholds (EPSS >0.5, CVSS >=9.0), and an executable command (`python scripts/security_scan.py`), but the bulk is "look for" pattern references rather than self-contained executable scanning code.	2 / 3
Workflow Clarity	Section 7 lays out a clear sequenced 4-phase methodology (Reconnaissance -> Discovery -> Analysis -> Reporting), but there are no explicit validate-then-fix-then-retry checkpoints; for batch scanning operations the rubric caps workflow clarity at 2 when validation feedback loops are missing.	2 / 3
Progressive Disclosure	The body is well organized into 11 numbered sections with a references table, but the referenced [checklists.md](checklists.md) does not exist in the bundle (broken link), scripts/dependency_analyzer.py is unreferenced, and content that could live in separate files (checklists, pattern catalogs) is inline, so it does not reach level 3.	2 / 3
	Total	8 / 12 Passed

Description

50%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description names a relevant, fairly specific security domain but reads as a topic list rather than a statement of concrete actions, and the description field omits any explicit "Use when..." trigger. It is competent but generic enough to cap most dimensions at 2.

Suggestions

Rewrite the description as concrete actions, e.g. "Scan codebases for security vulnerabilities, map the attack surface, and prioritize findings by risk".

Add an explicit trigger clause to the description field, e.g. "Use when scanning for vulnerabilities, checking OWASP 2025 compliance, or auditing supply chain security."

Broaden trigger terms to include common user phrasing such as "scan", "audit", "CVE", and "pentest".

Dimension	Reasoning	Score
Specificity	The description names several domains ("OWASP 2025, Supply Chain Security, attack surface mapping, risk prioritization") but lists topics rather than concrete verb-driven actions, so it falls short of the multiple-specific-actions anchor for 3 and above the vague/abstract anchor for 1.	2 / 3
Completeness	The description field answers "what" (vulnerability analysis principles and domains) but contains no "Use when..." clause or explicit trigger guidance; a separate when_to_use field exists, but the description field itself lacks the "when", capping completeness at 2 per the rubric guideline.	2 / 3
Trigger Term Quality	It includes natural terms a user might say ("vulnerability", "OWASP", "supply chain security"), but coverage is limited and omits common variations like "scan", "audit", or "CVE", so it is not the full-coverage level 3.	2 / 3
Distinctiveness Conflict Risk	The security/vulnerability niche is somewhat specific, but "vulnerability analysis" is broad enough to overlap with other security skills and the description field carries no distinct trigger phrases, so it does not reach the clear-niche-with-distinct-triggers level 3.	2 / 3
	Total	8 / 12 Passed

Validation

81%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 13 / 16 Passed

Validation for skill structure

Criteria	Description	Result
allowed_tools_field	'allowed-tools' contains unusual tool name(s)	Warning
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning
relative_links	Relative link issues: 1 missing	Warning

	Total	13 / 16 Passed

Repository: vudovn/ag-kit
Path: .agents/skills/vulnerability-scanner/SKILL.md
Commit: 04514f0

Reviewed: about 11 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.