CtrlK
BlogDocsLog inGet started
Tessl Logo

testland/sbom-diff

Compares two CycloneDX or SPDX SBOMs to surface net-new, removed, and version-changed components between image or build versions; uses cyclonedx-cli diff for structured output and syft-based generation for the input SBOMs; gates CI on net-new component introduction; enables supply-chain alerting when unexpected dependencies appear across releases. Use when the team needs to detect dependency drift between container image builds, release candidates, or dependency-update branches.

75

Quality

94%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Medium

Suggest reviewing before use

Overview
Quality
Evals
Security
Files

Quality

Content

85%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, actionable multi-step CI skill with executable commands, validation checkpoints, and proper progressive disclosure to a real reference file. Its main weakness is mild verbosity from repeated citation phrasing and an introductory narrative that restates known concepts.

Suggestions

Reduce the repeated 'Per [cdx-cli-gh][cdx-cli-gh]'/'Per [sf-gh][sf-gh]' framing — cite once per section or rely on the References list to cut token overhead.

Tighten the Overview paragraph so it states the workflow purpose without re-explaining what an SBOM diff conceptually is, which Claude already knows.

DimensionReasoningScore

Conciseness

Content is largely efficient and code blocks are lean, but the recurring 'Per [cdx-cli-gh][cdx-cli-gh]' citation framing and the Overview's narrative restating what an SBOM diff is add tokens that could be tightened.

2 / 3

Actionability

Provides copy-paste-ready commands throughout — install (brew/docker), syft generation, cyclonedx diff invocations, jq CI gates, and full GitHub Actions workflows in the referenced bundle.

3 / 3

Workflow Clarity

A clear six-step sequence (install → generate → diff → interpret → gate → alert) with explicit validation checkpoints: the jq gate exits non-zero on added components, an allowlist pattern, and a rotate-known-good-on-clean-diff feedback loop.

3 / 3

Progressive Disclosure

SKILL.md acts as a concise spine with a well-signaled, one-level-deep reference to references/ci-workflows.md (a real file) holding the full CI-gate and nightly-drift workflows; navigation is easy and content is appropriately split.

3 / 3

Total

11

/

12

Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that states concrete capabilities and gives an explicit 'Use when' trigger with natural domain terms. It is clearly distinguishable from sibling SBOM skills and avoids vague fluff.

DimensionReasoningScore

Specificity

Lists multiple concrete actions: 'Compares two CycloneDX or SPDX SBOMs to surface net-new, removed, and version-changed components', 'gates CI on net-new component introduction', and 'enables supply-chain alerting' — specific and comprehensive rather than vague.

3 / 3

Completeness

Explicitly answers what (compare SBOMs, surface changes, gate CI, alert) and when via the explicit 'Use when the team needs to detect dependency drift between container image builds, release candidates, or dependency-update branches' clause.

3 / 3

Trigger Term Quality

Uses natural domain terms a user would say: 'SBOM', 'dependency drift', 'container image builds', 'release candidates', and 'dependency-update branches', with good coverage of the phrasings teams use.

3 / 3

Distinctiveness Conflict Risk

The cross-version SBOM comparison niche is clearly distinct from single-SBOM generation or vulnerability scanning, and the description is scoped to drift detection so it is unlikely to trigger for sibling skills.

3 / 3

Total

12

/

12

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Reviewed

Table of Contents