CtrlK
BlogDocsLog inGet started
Tessl Logo
PluginPublic

testland/audit-trail-test-author

Use when audit logs need tests for HIPAA, PCI DSS, SOC 2, GDPR or another framework: the required events (logins, privilege changes, data access, admin actions, exports), structured log format, tamper-evident hash chains, immutability and retention, and replaying logs for forensics.

Quality

76%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

Overview
Quality
Evals
Security
Files

Quality

Content

63%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A dense, domain-rich skill with concrete assertion-based test patterns for every compliance requirement and a clearly sequenced 8-step workflow. It is held back by padding (redundant recap checklist, dead code in the forensic-replay test) and a monolithic structure that inlines framework reference material that belongs in separate files.

Suggestions

Cut the Step 8 end-to-end checklist (it restates Steps 1-7 verbatim) and the dead gap-computation loop in test 6, or replace both with a single one-line pointer to the step list.

Move the framework requirement tables (Overview, retention, per-framework additions) into references/ files (e.g. frameworks.md) and keep only the universal events table inline, adding clearly signaled one-level-deep links.

Add a short failure-handling note after the test patterns (e.g. what a broken hash-chain or failed aggregation assertion means and how to remediate) to close the workflow's missing feedback loop.

DimensionReasoningScore

Conciseness

The compliance tables and code carry real, non-obvious data, but there is padding: opening prose ('Audit logs are the universal compliance-evidence artifact'), a Step 8 checklist that restates Steps 1-7, and a gap-detection loop in test 6 that computes values then discards them ('Annotate: this would be domain-specific'). Fits 'mostly efficient but could be tightened' rather than the minor-trim anchor.

3 / 5

Actionability

Every step ships concrete, near-executable Python test code with real assertions (e.g. 'assert current.previous_event_hash == previous.this_event_hash', 'assert not re.search(r\"\\d{13,19}\\", audit_text)') plus a full JSON schema. Minor gaps: fixtures like 'user.access_phi' and 'service_a' are illustrative, undefined APIs, keeping it just short of copy-paste ready.

4 / 5

Workflow Clarity

Steps 1-8 are clearly sequenced and Step 8 provides an explicit end-to-end checklist ('1. ✅ Required events emitted...'), with each step's assertions acting as checkpoints. It misses anchor 5's feedback loops — there is no guidance on what to do when a test fails or how to remediate.

4 / 5

Progressive Disclosure

A single ~280-line file with well-organized sections, but the framework-requirements tables and per-framework additions are inlined where a skill of this size would benefit from splitting into references/ files; the References section points to external URLs rather than navigable bundle files.

3 / 5

Total

14

/

20

Passed

Description

78%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description with an explicit 'Use when' trigger, named frameworks, and a concrete enumeration of the test coverage areas. Its main weakness is that the skill's action (authoring tests) is implied rather than stated, and a few natural trigger terms like 'compliance' are absent.

DimensionReasoningScore

Specificity

Enumerates concrete coverage areas ('required events (logins, privilege changes, data access, admin actions, exports), structured log format, tamper-evident hash chains, immutability and retention'), but the skill's action ('author tests') is never stated as a verb, only implied by 'need tests' — matching the several-specific-actions-with-minor-gaps anchor rather than comprehensive.

4 / 5

Completeness

Both elements are present — an explicit 'Use when audit logs need tests for...' trigger and a colon-delimited list of what is tested — but the 'what' is embedded inside the when-clause instead of being stated as its own action, which fits the anchor where 'when' or 'what' could be more explicit.

4 / 5

Trigger Term Quality

Strong natural keywords ('audit logs', 'tests', 'HIPAA', 'PCI DSS', 'SOC 2', 'GDPR', 'forensics') that users would actually say, but common variations like 'compliance', 'audit trail', or 'SOC2' are missing, so coverage is good rather than comprehensive.

4 / 5

Distinctiveness Conflict Risk

Named compliance frameworks plus niche phrases like 'tamper-evident hash chains' and 'immutability and retention' carve a clear trigger space with minimal overlap against generic logging or testing skills.

5 / 5

Total

17

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Reviewed

On this page