CtrlK
BlogDocsLog inGet started
Tessl Logo
PluginPublic

testland/attack-surface-test-checklist

Use when a pull request, release branch or feature is about to be security tested and needs a targeted test list. Maps the changed code to nine attack surfaces and attaches OWASP ASVS 4.0.3 requirements, Top 10 2021 IDs and WSTG sections, only for surfaces the change touches.

Quality

89%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

Overview
Quality
Evals
Security
Files

Quality

Content

86%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a well-structured, highly actionable methodology: concrete classification tables, sequenced steps with honesty rules, an exact output contract, and a worked example, with the bulk of the item catalog correctly offloaded to a one-level-deep reference. The only deductions are mild repetition of the not-a-sign-off caveat and the absence of an explicit classification re-check step.

Suggestions

Consolidate the 'not established by this checklist' caveat to the Output format item and the worked example; the Overview, Differentiation axis, and Anti-patterns repeats of the same point can be trimmed to a single cross-reference.

Add an explicit Step 5 verification checkpoint, e.g. 're-read the changed files for content signals that contradict the path-based classification before emitting the checklist', to close the workflow validation gap.

Tighten the ASVS level definitions in 'Which ASVS version this uses' to the one-sentence default rule (Level 1, escalate to Level 2 for credential/session-token changes) and drop the quoted level descriptions.

DimensionReasoningScore

Conciseness

Nearly every section carries non-obvious domain data (ASVS requirement IDs, WSTG section mappings, tagging gotchas), and version-sensitive material is quarantined in a dedicated version section and Limitations. Minor trimmable fat remains: the 'not a sign-off' caveat repeats across five places, and the ASVS level definitions are discursive, so it sits just below the lean-every-token-earns-its-place anchor.

4 / 5

Actionability

For an instruction-only skill the guidance is fully executable: a concrete classification table with path and content signals, per-surface ASVS chapters, a seven-part output format spec, a fully rendered worked example showing the exact output, and an anti-patterns table with correct behavior — copy-paste-ready shape covering the common case.

5 / 5

Workflow Clarity

Steps 1–4 are clearly sequenced with a built-in correction mechanism ("path first, content second", content signals override path) and explicit exclusion bookkeeping, and no destructive/batch cap applies. It stops short of the top anchor because there is no explicit final re-verification pass confirming the surface classification before emitting the checklist.

4 / 5

Progressive Disclosure

Scored against the actual bundle: SKILL.md is a clear overview, and the single reference (references/per-surface-test-items.md, verified to exist) is well-signaled in Step 4, exactly one level deep, and appropriately split — Authentication stays inline as the worked example of item shape while the other eight surfaces live in the reference, matching the clear-overview anchor.

5 / 5

Total

18

/

20

Passed

Description

88%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description: it names concrete actions, uses third person, and pairs an explicit 'Use when...' trigger with a clear capability statement. Trigger synonym coverage and separation from generic security-review skills are the only soft spots.

DimensionReasoningScore

Specificity

"Maps the changed code to nine attack surfaces and attaches OWASP ASVS 4.0.3 requirements, Top 10 2021 IDs and WSTG sections, only for surfaces the change touches" lists multiple concrete actions in third person voice with no coverage gaps for its niche, matching the comprehensive-coverage anchor rather than the 'minor gaps' anchor below it.

5 / 5

Completeness

Both parts are explicit: an "Use when a pull request, release branch or feature is about to be security tested and needs a targeted test list" trigger clause and a clear statement of what it does (maps changed code to nine attack surfaces with ASVS/Top 10/WSTG tags), matching the anchor for concrete what-and-when completeness.

5 / 5

Trigger Term Quality

Natural phrases users would say are present ("pull request", "release branch", "security tested", "targeted test list"), but common variations such as "pentest", "security review", or "security checklist" are missing, so it falls between good coverage and comprehensive synonym coverage.

4 / 5

Distinctiveness Conflict Risk

It carves a clear niche (per-change test-list generation, not triage or full assessment), but a request like "security test this PR" could plausibly also match a general security-review skill, leaving minor overlap risk with closely related skills rather than minimal conflict risk.

4 / 5

Total

18

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Reviewed

On this page