tessl/default-skill-review
The default Tessl review rubric. An agentic reviewer that reads a SKILL.md and scores it against rubrics for its description and its content, the same reviewer tessl review uses out of the box. Use it as the reference reviewer to score skills, or as the base to fork a custom rubric from.
75
94%
Does it follow best practices?
Impact
—
No eval scenarios have been run
Risky
Do not use without reviewing
Security
1 high severity finding. You should review these findings carefully before considering using this skill.
W007: Insecure credential handling detected in skill instructions
What this means
The skill handles credentials insecurely by requiring the agent to include secret values verbatim in its generated output. This exposes credentials in the agent’s context and conversation history, creating a risk of data exfiltration.
Why it was flagged
Insecure credential handling detected (high risk: 0.90). The prompt requires the agent to "quote the specific phrases from the target text" and include file-derived text in generated outputs (results.json), which forces verbatim reproduction of any secrets present in SKILL.md or bundled files — creating an exfiltration risk.
- Audited
- Security analysis