CtrlK
BlogDocsLog inGet started
Tessl Logo

testland/bandit-python

Configures and runs Bandit - Python-only SAST covering 60+ rule IDs across 7 categories (B1xx-B7xx: misc, app, crypto, imports, injections, XSS); `bandit -r .` scan, `--severity-level` + `--confidence-level` filtering, `# nosec`/`# nosec B404` per-line and per-rule suppression, `pyproject.toml [tool.bandit]` config. Use for a focused, low-overhead Python SAST in pre-commit / CI. Python-only: for Go use gosec-go, for cross-language pattern SAST use semgrep-rules; to merge Bandit findings with other scanners into one gate use multi-tool-finding-triage - not this for non-Python code.

75

Quality

94%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

Overview
Quality
Evals
Security
Files

Quality

Content

85%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with executable, copy-paste-ready commands and config across a clear 9-step workflow with triage checkpoints and feedback loops. The only weakness is mild verbosity from repeated source framing and a small amount of conceptual explanation.

Suggestions

Remove the repeated 'Per [bd-start]' framing from Steps 1-3 and cite the reference once, since the link already conveys provenance.

Tighten the Overview's severity/confidence explanation to a single line; Bandit's two-dimensional scoring is well-known and the detail adds tokens without adding actionability.

DimensionReasoningScore

Conciseness

The body is mostly lean and action-oriented, but the repeated 'Per [bd-start]' framing and the conceptual severity/confidence explanation in the Overview could be tightened, so it sits at 'mostly efficient but could be tighter' rather than the fully lean level 3.

2 / 3

Actionability

Provides fully executable commands and complete config blocks (bandit CLI flags, pyproject.toml, pre-commit YAML, GitHub Actions) with specific rule IDs, matching the 'fully executable, copy-paste ready' anchor.

3 / 3

Workflow Clarity

A clear Step 1-9 sequence with an explicit quarterly triage checkpoint and feedback guidance (baseline ratcheting, PR-blocking filter) in the triage/CI steps, satisfying the 'explicit validation steps and feedback loops' anchor.

3 / 3

Progressive Disclosure

Well-organized sections with one-level-deep references (the [bd-start] link and a References list of docs and sister scanners), no nested bundling, and no bundle files present — clean single-file organization per the simple-skill note.

3 / 3

Total

11

/

12

Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is highly specific, action-oriented, and clearly distinguishes Bandit from sister scanners with explicit cross-references. It answers both 'what' and 'when' with natural trigger terms. No changes needed.

DimensionReasoningScore

Specificity

Lists multiple concrete actions (scan, severity/confidence filtering, per-line and per-rule suppression, pyproject config) with specific CLI flags, matching the 'lists multiple specific concrete actions' anchor rather than the partial coverage of level 2.

3 / 3

Completeness

Explicitly answers both what it does and when to use it ('Use for a focused, low-overhead Python SAST in pre-commit / CI'), meeting the 'clearly answers both what AND when with explicit triggers' anchor.

3 / 3

Trigger Term Quality

Includes natural terms a user would say ('Python', 'Bandit', 'SAST', 'pre-commit / CI') with good coverage of variations, beyond the 'some relevant keywords' of level 2.

3 / 3

Distinctiveness Conflict Risk

The Python-only niche is reinforced with explicit routing to gosec-go, semgrep-rules, and multi-tool-finding-triage, giving a clear niche unlikely to conflict.

3 / 3

Total

12

/

12

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Reviewed

Table of Contents