CtrlK
BlogDocsLog inGet started
Tessl Logo

testland/osv-scanner

Configures and runs Google OSV-Scanner - open-source SCA against the OSV.dev vulnerability database; supports `osv-scanner scan -r ./` recursive scan + per-lockfile scan via `-L package-lock.json`; SBOM input (CycloneDX / SPDX) for non-standard package managers; `--format json|sarif|markdown|vertical|html` output; suppressions via `osv-scanner.toml` config. Use when the team needs OSS-native SCA without commercial-license overhead, or wants a second-opinion DB pair with Snyk's commercial DB.

71

Quality

89%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

Overview
Quality
Evals
Security
Files

Quality

Content

87%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, actionable, and token-efficient reference skill that defers detail to a real one-level-deep bundle file. The only gap is workflow clarity: validation signals exist but are not woven into an explicit end-to-end validate-and-retry loop.

Suggestions

Add an explicit feedback loop in Step 6/7 — e.g. after suppressing a CVE in osv-scanner.toml, re-run the scan to confirm the finding is gone before merging the CI gate.

Frame the scan->triage->suppress->re-scan path as a single gated procedure with an explicit checkpoint rather than separate topical steps.

DimensionReasoningScore

Conciseness

Lean and command/table-driven with no padding of concepts Claude already knows; every section (install, scan, formats, SBOM, config, triage, exit codes, license) earns its place, and full schemas are deferred to the reference file.

3 / 3

Actionability

Provides copy-paste-ready executable commands throughout (docker pull, go install, brew install, `scan -r`, `scan -L`, `--sbom`, toml snippets, exit-code table, GHA workflow) with specific flags and examples.

3 / 3

Workflow Clarity

A clear numbered sequence (Steps 1-8) with validation signals (exit-code table, CI gating, a MANDATORY triage step) is present, but the checkpoints are not knitted into an explicit validate->fix->retry procedural gate, leaving validation implicit rather than a tight feedback loop.

2 / 3

Progressive Disclosure

SKILL.md is a concise overview that signals a single one-level-deep reference (references/osv-scanner-config-and-ci.md) multiple times for the full schema, triage template, and CI workflow; the referenced file exists and matches, with no nested reference chains.

3 / 3

Total

11

/

12

Passed

Description

85%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that covers concrete capabilities and an explicit Use-when trigger with good distinctiveness. The main weakness is trigger-term quality: the phrasing leans on internal jargon rather than the plain terms a user would naturally say.

Suggestions

Add simpler, user-natural trigger terms (e.g. "open-source vulnerability scanner", "free SCA tool", "Snyk alternative") alongside the OSS-native SCA / second-opinion phrasing.

Soften jargon like "OSS-native SCA without commercial-license overhead" toward phrasings a requester would actually type.

DimensionReasoningScore

Specificity

Lists multiple concrete actions — "Configures and runs Google OSV-Scanner", recursive scan (`osv-scanner scan -r ./`), per-lockfile scan (`-L`), SBOM input, multiple `--format` outputs, and suppressions via `osv-scanner.toml` — matching the anchor for several specific concrete actions.

3 / 3

Completeness

Clearly answers both what ("Configures and runs Google OSV-Scanner ... suppressions via osv-scanner.toml") and when with an explicit "Use when the team needs OSS-native SCA ... or wants a second-opinion DB pair with Snyk's commercial DB" clause.

3 / 3

Trigger Term Quality

Includes relevant domain keywords (OSV-Scanner, OSV.dev, SBOM, SCA, Snyk) but the trigger phrasing is jargon-heavy ("OSS-native SCA without commercial-license overhead", "second-opinion DB pair") and misses simpler natural variations like "open-source vulnerability scanner" or "free Snyk alternative".

2 / 3

Distinctiveness Conflict Risk

OSV-Scanner is a distinct OSS SCA tool with a clear niche (OSV.dev DB, Snyk cross-DB pairing); the SCA/SBOM/Snyk triggers are specific and unlikely to fire for the wrong skill.

3 / 3

Total

11

/

12

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Reviewed

Table of Contents