CtrlK
BlogDocsLog inGet started
Tessl Logo

testland/osv-scanner

Configures and runs Google OSV-Scanner - open-source SCA against the OSV.dev vulnerability database; supports `osv-scanner scan -r ./` recursive scan + per-lockfile scan via `-L package-lock.json`; SBOM input (CycloneDX / SPDX) for non-standard package managers; `--format json|sarif|markdown|vertical|html` output; suppressions via `osv-scanner.toml` config. Use when the team needs OSS-native SCA without commercial-license overhead, or wants a second-opinion DB pair with Snyk's commercial DB.

76

Quality

95%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

Overview
Quality
Evals
Security
Files

Quality

Content

100%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-architected skill body: lean and actionable with executable commands at every step, a clearly sequenced workflow including a mandatory triage feedback loop, and exemplary one-level-deep progressive disclosure into a single real reference file.

DimensionReasoningScore

Conciseness

Lean body that assumes Claude's competence — no preamble explaining what SCA, lockfiles, or SBOMs are — and every line carries actionable content; the occasional 'verify against current docs' hedges earn their place given CLI drift.

5 / 5

Actionability

Provides copy-paste-ready commands for install, recursive/per-lockfile scan, SBOM input, a full output-format table, a real `osv-scanner.toml` snippet, exit codes, and CI workflow — covering the common cases concretely.

5 / 5

Workflow Clarity

A clear 8-step sequence with an explicitly MANDATORY triage step (Step 6), enforced `ignoreUntil` re-surfacing as a validation feedback loop, and CI gating via exit codes — destructive/batch suppression operations carry explicit checkpoints.

5 / 5

Progressive Disclosure

SKILL.md is an overview that repeatedly and clearly signals one reference file (`references/osv-scanner-config-and-ci.md`) one level deep for the full schema, triage template, and CI workflow; that file exists and holds the bulk detail.

5 / 5

Total

20

/

20

Passed

Description

88%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description with concrete capabilities and an explicit Use-when clause carving out a distinct OSS-SCA niche. Slightly keyword-sparse on natural synonyms and file extensions, which keeps trigger term quality just below maximum.

Suggestions

Add a few natural synonyms/request phrasings a user might say (e.g. 'dependency vulnerabilities', 'transitive dep audit', 'lockfile scan') to lift trigger term coverage.

Consider mentioning the most common lockfile names (package-lock.json, go.mod, Cargo.lock) as natural keywords to improve distinctiveness from generic SCA skills.

DimensionReasoningScore

Specificity

Lists multiple concrete actions — recursive scan (`scan -r ./`), per-lockfile scan (`-L`), SBOM input, multiple output formats, and suppressions via `osv-scanner.toml` — giving comprehensive capability coverage.

5 / 5

Completeness

Explicitly states what the tool does (SCA against OSV.dev with concrete sub-features) and provides a concrete 'Use when...' clause with two distinct triggering scenarios.

5 / 5

Trigger Term Quality

Includes natural phrases users would say ('OSS-native SCA', 'second-opinion DB pair', 'without commercial-license overhead', 'Snyk's commercial DB') but is light on common synonyms/file extensions a requester might use.

4 / 5

Distinctiveness Conflict Risk

Names a specific tool (OSV-Scanner) and its DB (OSV.dev) with a clear OSS/commercial niche, leaving only minor overlap risk against sibling SCA skills like `snyk-test`.

4 / 5

Total

18

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Reviewed

Table of Contents