tessleng/context-findings
Understand your Context and address its Findings for the current repo
71
89%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
source SKILL.md describes reading Tessl “Findings” evidence inline from the org Findings endpoint (including skillInstance body/frontmatter/path) during steps 2 and 4, and Findings evidence is sourced from the user’s scanned workspace content, so outsider-authored text can be ingested via externally authored skills in the repo.
Where we found it
org Findings endpoint (Tessl API)
content-type · 5 sites
The skill describes fetching Finding evidence from the Tessl org Findings endpoint via `tessl api`, which returns skillInstance body/frontmatter/path sourced from the user's scanned workspace — including externally authored skills that could contain outsider-controlled text.
SKILL.md
33
The Findings endpoint resolves each Finding's evidence inline, so the artifacts arrive on the response itself.
SKILL.md
37
- `logicalSkill`: the logical (registry) skill the Finding concerns, with `canonicalRepo`, `canonicalName`, `body`, `frontmatter`, and `instanceCount` (or `null`).
SKILL.md
40
- `skillInstance`: the concrete skill installed or vendored in a repo, with `path`, `body`, `frontmatter`, `frontmatterError`, and repo details (or `null`).
SKILL.md
73
2. **Fetch active Findings for this workspace.** Use `tessl/api` `search`/`show` to inspect the org Findings endpoint, then call it via `tessl api` with the status filter set to `active`
SKILL.md
92
4. **Read the inline evidence before fixing.** For an ungated Finding, each row already carries its artifacts inline (`logicalSkill`, `skillInstance`, `clusterMembers`, `instances`).
workspace Context collection (Tessl API)
content-type · 4 sites
The skill describes reading the workspace Context collection via `tessl/api`, which contains skills and plugins observed in the workspace's repositories — including externally authored skills that could contain outsider-controlled text.
SKILL.md
13
**Context** is the collection of skills and plugins Tessl has observed for a workspace: the copies indexed in the workspace's repositories and the plugins it has published to the registry.
SKILL.md
97
5. **Read Context for the wider picture.** When a fix needs to know where a skill already lives or whether it's published, read the workspace Context collection via `tessl/api`.
SKILL.md
98
skill already lives or whether it's published, read the workspace Context collection via `tessl/api`. Each row reports `states` (`published`,
SKILL.md
99
`inCodebases`), the `canonical` location, `locations` counts, and `containment` (the plugin it belongs to).
- Audited
- Security analysis