CtrlK
BlogDocsLog inGet started
Tessl Logo

testland/language-native-sast

Language-native SAST linters - the first-party "linter as SAST" family that runs inside each ecosystem's standard toolchain with no separate scanner server: Bandit (Python, 60+ B-rules, severity x confidence filtering), gosec (Go, 40+ G-rules, AST + SSA taint tracking, golangci-lint integration), eslint-plugin-security + eslint-plugin-no-unsanitized (JS/TS, 14 detect-* rules + DOM-sink XSS), and PMD's Apex security ruleset (Salesforce, ApexSOQLInjection / ApexCRUDViolation / ApexSharingViolations). Covers the shared adoption pattern - install as a dev dependency, first scan, suppression-with-justification discipline, baseline-diff adoption for legacy code, SARIF output + CI gating - with per-tool depth in references. Use when a repo needs in-toolchain security linting for Python, Go, JavaScript/TypeScript, or Apex; for cross-language or cross-file taint analysis use semgrep-rules / codeql-queries instead.

72

Quality

91%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Low

Low-risk findings worth noting

Overview
Quality
Evals
Security
Files

Quality

Content

86%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is well-structured, actionable, and uses progressive disclosure effectively, with concrete commands and a real worked example. The main weakness is the absence of an explicit error-recovery/validate-retry loop in the workflow and a few motivational asides that could be trimmed.

Suggestions

Add an explicit validate->fix->retry loop (e.g. for the baseline-diff or first-scan step) so the workflow has a concrete error-recovery checkpoint.

Trim motivational asides like 'it versions, caches, and updates like any other dev dependency' that restate what Claude can infer from a dev-dependency install.

Surface the Apex install command inline in Step 1 rather than deferring entirely to the reference, to match the executable depth of the other three tools.

DimensionReasoningScore

Conciseness

Mostly lean with copy-paste commands and tight tables, but a few editorial asides ('it versions, caches, and updates like any other dev dependency', 'an unfiltered first run is how teams end up disabling the linter') explain motivation Claude could infer — minor trimming opportunities.

4 / 5

Actionability

Provides copy-paste-ready bash, a complete flat eslint.config.js, a suppression-syntax table with exact syntax per tool, and CI YAML — fully executable guidance covering the common install/scan/suppress/gate cases.

5 / 5

Workflow Clarity

Five clearly sequenced steps with a MANDATORY marker on suppression and an anti-patterns table; however there is no explicit validate->fix->retry error-recovery loop for the scan/baseline flow, leaving a minor validation gap.

4 / 5

Progressive Disclosure

SKILL.md is a concise overview with the shared pattern and one worked example, pointing via a table and References section to four real one-level-deep files (bandit.md, gosec.md, eslint-security.md, pmd-apex.md, all present in references/) for per-tool depth — easy navigation, no nested indirection.

5 / 5

Total

18

/

20

Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, trigger-rich, and explicitly answers both what and when while drawing a clear boundary against sibling SAST skills. It uses third-person voice throughout with no first/second-person slip. Minor room to add file extensions for slightly richer trigger terms.

DimensionReasoningScore

Specificity

Lists multiple concrete per-tool capabilities (Bandit '60+ B-rules, severity x confidence filtering', gosec 'AST + SSA taint tracking', '14 detect-* rules + DOM-sink XSS', 'ApexSOQLInjection / ApexCRUDViolation') plus concrete adoption actions ('install as a dev dependency, first scan, suppression-with-justification discipline, baseline-diff adoption, SARIF output + CI gating') — comprehensive coverage.

5 / 5

Completeness

Clearly states both what (the four linters and the shared adoption pattern) and an explicit 'Use when a repo needs in-toolchain security linting for Python, Go, JavaScript/TypeScript, or Apex' trigger, plus a concrete differentiation ('for cross-language or cross-file taint analysis use semgrep-rules / codeql-queries instead').

5 / 5

Trigger Term Quality

Strong natural keyword coverage with tool names (Bandit, gosec, eslint-plugin-security, PMD) and languages (Python, Go, JS/TS, Apex) plus 'security linting', 'SARIF', 'CI gating'; but file extensions (e.g. .py, .go, .js) and common synonyms are not enumerated, leaving a few natural terms missing.

4 / 5

Distinctiveness Conflict Risk

Occupies a clear niche (first-party in-toolchain linters) with distinct triggers and an explicit boundary against semgrep-rules / codeql-queries for cross-language or cross-file taint analysis, minimizing conflict risk.

5 / 5

Total

19

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Reviewed

Table of Contents