CtrlK
BlogDocsLog inGet started
Tessl Logo

testland/npm-pip-maven-audit

Configures and runs native package-manager audit commands across ecosystems - `npm audit --audit-level=high` (npm), `yarn npm audit` (Yarn 2+), `pnpm audit` (pnpm), `pip-audit` (Python via PyPA), `mvn dependency:check` (Maven via OWASP Dependency-Check plugin), `cargo audit` (Rust), `bundle audit` (Ruby Bundler); fastest no-install-required SCA option. Use when the team wants fast, no-extra-tooling SCA in CI as a first line of defense, or pairs with snyk/osv-scanner for layered coverage.

75

Quality

94%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

Overview
Quality
Evals
Security
Files

Quality

Content

85%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, highly actionable skill body with a clear sequenced workflow, a mandatory triage feedback loop, and clean one-level-deep progressive disclosure. The main inefficiency is duplicated documentation URLs across inline `Source:` lines and the References section.

Suggestions

Remove the duplicated documentation URLs: they appear both as inline `Source:` lines after each step and again in the References section — keep them in only one place (preferably References).

If keeping per-step provenance, replace the full inline URLs with a short pointer to the References section to trim ~7 lines of repeated tokens.

DimensionReasoningScore

Conciseness

The body is largely lean and command-dense, but documentation URLs are duplicated — each step carries a `Source:` line and the References section repeats the same URLs — so it could be tightened rather than earning the 'every token earns its place' level 3.

2 / 3

Actionability

Provides fully executable, copy-paste-ready commands for every ecosystem plus a concrete CI yaml with `hashFiles` auto-skip gates, matching the 'fully executable code/commands' anchor rather than the pseudocode level 2.

3 / 3

Workflow Clarity

Seven steps are clearly sequenced with Step 6 'MANDATORY' false-positive triage as the feedback loop and CI exit-code propagation, satisfying the explicit-validation/checklist anchor rather than the checkpoint-missing level 2.

3 / 3

Progressive Disclosure

SKILL.md is an overview that points four times to a single real one-level-deep reference (references/ecosystem-config-and-triage.md) for detailed config and templates, matching the well-signaled one-level-deep anchor.

3 / 3

Total

11

/

12

Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description with concrete per-ecosystem commands, natural trigger terms, an explicit 'Use when' clause, and a distinct niche separated from sister scanners. Its only weakness is verbosity from inline-listing seven tools, though that density is concrete rather than fluffy.

DimensionReasoningScore

Specificity

Lists multiple concrete audit commands per ecosystem (`npm audit --audit-level=high`, `pip-audit`, `mvn dependency:check`, `cargo audit`, `bundle audit`), matching the 'lists multiple specific concrete actions' anchor rather than the domain-only level 2.

3 / 3

Completeness

Explicitly answers both what ('Configures and runs native package-manager audit commands across ecosystems') and when via an explicit 'Use when the team wants fast, no-extra-tooling SCA in CI...' clause, so it is not capped at 2.

3 / 3

Trigger Term Quality

Covers natural terms users would say — 'audit', 'SCA', 'CI', plus concrete tool names (npm, pip-audit, snyk, osv-scanner) — giving good coverage rather than the partial level-2 set.

3 / 3

Distinctiveness Conflict Risk

Occupies a clear native-audit niche and explicitly distinguishes itself from the snyk/osv-scanner sister tools, making wrong-skill triggering unlikely rather than the overlapping level-2 case.

3 / 3

Total

12

/

12

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Reviewed

Table of Contents