CtrlK
BlogDocsLog inGet started
Tessl Logo

testland/snyk-test

Configures and runs Snyk, a commercial multi-mode scanner: snyk test for SCA (dependency scanning), snyk code test for SAST (code security scanning), snyk container test for container images, snyk iac test for IaC (infrastructure-as-code), snyk monitor for continuous new-vuln alerts; policy file .snyk for ignore + patch. Use when the team has a Snyk license and needs SCA (dependency scanning) or continuous vuln monitoring; for open-source scanning without a Snyk license, prefer osv-scanner.

75

Quality

94%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

Overview
Quality
Evals
Security
Files

Quality

Content

85%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

An actionable, well-sequenced SCA skill with strong progressive disclosure via a real reference file; its only weakness is mild redundancy between the body's subcommand table/Worked example and the frontmatter plus step content.

Suggestions

Drop the top subcommand table or collapse it to a single line — it duplicates the subcommand enumeration already in the frontmatter description.

Trim the Worked example to the decisions unique to the scenario (triage of the unreachable lodash path and the cross-tool pairing) rather than re-listing the --severity-threshold, .snyk ignore, and monitor commands covered in Steps 2–5.

Remove inline glosses like 'SCA (open-source dependencies)' in the body table since those acronyms are already expanded in the frontmatter.

DimensionReasoningScore

Conciseness

Mostly efficient and command-dense, but the top subcommand table restates the frontmatter enumeration and the Worked example re-walks the --severity-threshold, .snyk ignore, and monitor commands already detailed in Steps 2–5, so it could be tightened.

2 / 3

Actionability

Provides fully executable, copy-paste-ready guidance throughout — 'npm install -g snyk', 'snyk test --all-projects --severity-threshold=high', real GHA action versions, and a complete .snyk policy block with all required fields.

3 / 3

Workflow Clarity

Steps 1–6 are clearly sequenced with validation checkpoints — the scan-time 'expires:' enforcement, --fail-on=upgradable / --severity-threshold gates, and a quarterly re-review feedback loop — plus an Anti-patterns checklist for error recovery.

3 / 3

Progressive Disclosure

Keeps the policy detail in a well-signaled one-level-deep reference ('Full policy schema...: references/snyk-policy-and-triage.md') that exists and is appropriately split from the overview, with clear navigation.

3 / 3

Total

11

/

12

Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that enumerates concrete subcommands, gives an explicit 'Use when' trigger, and carves out a distinct Snyk-licensed SCA niche with clear redirects to alternative tools.

DimensionReasoningScore

Specificity

Lists multiple concrete actions — 'snyk test for SCA', 'snyk code test for SAST', 'snyk container test', 'snyk iac test', 'snyk monitor for continuous new-vuln alerts', 'policy file .snyk for ignore + patch' — matching the 'lists multiple specific concrete actions' anchor.

3 / 3

Completeness

Explicitly answers both 'what' (configures/runs Snyk across named subcommands) and 'when' via a literal 'Use when the team has a Snyk license and needs SCA... or continuous vuln monitoring' trigger clause.

3 / 3

Trigger Term Quality

Covers natural terms a user would say ('dependency scanning', 'continuous vuln monitoring', 'open-source scanning', 'Snyk license') with acronyms expanded, rather than jargon-only phrasing.

3 / 3

Distinctiveness Conflict Risk

Scoped to Snyk-licensed SCA with explicit redirects for adjacent surfaces (osv-scanner for unlicensed OSS, semgrep/trivy implied for SAST/container), giving it a clear niche unlikely to trigger the wrong skill.

3 / 3

Total

12

/

12

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Reviewed

Table of Contents