CtrlK
BlogDocsLog inGet started
Tessl Logo

testland/kics-policy

Configures KICS (Keeping Infrastructure as Code Secure), Checkmarx's scanner covering Terraform, Kubernetes, Helm, Dockerfile, OpenAPI, Ansible, ARM, CloudFormation, Pulumi, Crossplane - CLI / Docker / GitHub Action / pre-commit, JSON / SARIF / HTML / JUnit output, custom Rego queries. Use for the widest platform breadth, especially OpenAPI / Pulumi / Crossplane; for the broadest built-in checks with Python custom rules use checkov-policy, for Terraform-only scanning use tfsec-policy, and for a consolidated scanner use trivy-config.

76

Quality

95%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Low

Low-risk findings worth noting

Overview
Quality
Evals
Security
Files

Quality

Content

87%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is lean, highly actionable, and well-structured with one-level-deep progressive disclosure. Its main weakness is workflow_clarity: the multi-step scan flow lacks explicit validation/verification checkpoints and a feedback loop for triaging findings.

Suggestions

Add an explicit verification checkpoint after scanning (e.g. 'Review results/ output; confirm exit code reflects --fail-on severity before failing CI') to close the validation gap.

Include a short scan → triage → fix → re-scan feedback loop so the workflow reads as iterative rather than fire-and-forget.

Show how to inspect a specific finding (the query ID + file:line in JSON/SARIF output) so users can act on results directly from the body.

DimensionReasoningScore

Conciseness

The body is lean — tight numbered steps with compact code blocks and one-line framing; it does not re-explain concepts Claude already knows, and nearly every token earns its place. A few editorial lines (e.g. "For most teams, this is the unique reason to use KICS alongside Checkov") are tool-specific guidance rather than padding.

3 / 3

Actionability

Provides fully executable, copy-paste-ready commands (docker pull/run, kics scan flag variants, CI GitHub Action YAML) and concrete directives with real query-ID formats, matching the executable-and-complete anchor.

3 / 3

Workflow Clarity

The 9 steps are clearly sequenced (Install → Run → Output → Severity → Skip → Custom queries → CI → OpenAPI → Pulumi), but there are no explicit validation checkpoints or feedback loops (e.g. verify scan output, inspect findings before acting); checkpoints are only implicit via --fail-on and CI `if: always()`.

2 / 3

Progressive Disclosure

The SKILL.md spine is an overview that points via clearly-signaled links to a single one-level-deep reference (references/kics-policy.md, verified present) holding the pinned-install, full Rego template, and anti-patterns table — content is appropriately split with easy navigation.

3 / 3

Total

11

/

12

Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, trigger-rich, complete, and distinctively scoped with explicit guidance on when to prefer KICS over sibling scanners. It uses third-person voice and avoids vague fluff. No changes needed.

DimensionReasoningScore

Specificity

Enumerates many concrete capabilities — platforms ("Terraform, Kubernetes, Helm, Dockerfile, OpenAPI, Ansible, ARM, CloudFormation, Pulumi, Crossplane"), install paths ("CLI / Docker / GitHub Action / pre-commit"), output formats ("JSON / SARIF / HTML / JUnit"), and "custom Rego queries" — matching the multiple-specific-actions anchor.

3 / 3

Completeness

Answers both what ("Configures KICS ... scanner covering [platforms] ... output, custom Rego queries") and when with an explicit trigger clause ("Use for the widest platform breadth, especially OpenAPI / Pulumi / Crossplane; ... use checkov-policy ... tfsec-policy ... trivy-config").

3 / 3

Trigger Term Quality

Uses natural terms users would say ("Terraform", "Kubernetes", "OpenAPI", "Pulumi", "scan") and third-person voice ("Configures KICS"), giving good coverage without jargon-only phrasing.

3 / 3

Distinctiveness Conflict Risk

A clear single-tool niche with explicit routing away from sister scanners ("use checkov-policy", "use tfsec-policy", "use trivy-config"), making it unlikely to trigger for the wrong skill.

3 / 3

Total

12

/

12

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Reviewed

Table of Contents