CtrlK
BlogDocsLog inGet started
Tessl Logo

testland/bug-report-template

Builds a well-formed bug (defect) report from raw observation notes - fills in summary, environment, steps to reproduce, expected vs actual, and severity rationale - and validates that each field has the load-bearing content reviewers and engineers need to triage. Also converts a single test-failure record (JUnit XML, Allure JSON, pytest log, Playwright report) into a classified, ready-to-file bug spec, and provides the adversarial review checklist that gates a report before it enters the tracker (required fields, single-description title test, severity-priority independence, reproduction quality). Use when a stakeholder reports a problem informally, when a CI failure artefact needs to become a triageable report, or when a drafted report needs a pre-filing quality audit.

81

0.88x
Quality

95%

Does it follow best practices?

Impact

80%

0.88x

Average score across 10 eval scenarios

SecuritybySnyk

High

Do not use without reviewing

Overview
Quality
Evals
Security
Files

Security

1 high severity finding. You should review these findings carefully before considering using this skill.

High

W007: Insecure credential handling detected in skill instructions.

What this means

The skill handles credentials insecurely by requiring the agent to include secret values verbatim in its generated output. This exposes credentials in the agent’s context and conversation history, creating a risk of data exfiltration.

Why it was flagged

The skill explicitly instructs extracting and pasting verbatim error messages, stack traces, and logs into the bug report (Actual field), which can cause the LLM to output sensitive secrets or tokens contained in those artifacts.

Report incorrect finding

Low

Low-risk findings.

1 low severity finding. Worth noting, but not necessarily harmful.

Low

W011: Third-party content exposure detected (indirect prompt injection risk).

What this means

The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.

Why it was flagged

SKILL.md describes a workflow that takes raw outsider-authored text from a chat message/voice memo/copy-pasted error at runtime (Step 1: “From the input…extract…verbatim error messages…exact UI surface…environment details…expected vs actual”), then uses it to populate the bug report template.

Audited
Security analysis
Snyk