CtrlK
BlogDocsLog inGet started
Tessl Logo

testland/snyk-test

Configures and runs Snyk, a commercial multi-mode scanner: snyk test for SCA (dependency scanning), snyk code test for SAST (code security scanning), snyk container test for container images, snyk iac test for IaC (infrastructure-as-code), snyk monitor for continuous new-vuln alerts; policy file .snyk for ignore + patch. Use when the team has a Snyk license and needs SCA (dependency scanning) or continuous vuln monitoring; for open-source scanning without a Snyk license, prefer osv-scanner.

72

Quality

91%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

Overview
Quality
Evals
Security
Files

Quality

Content

86%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a well-structured, highly actionable SCA workflow with a clean one-level reference for triage detail and a mandatory-suppression checkpoint plus re-review loop. Minor conciseness drift (repeated mode table, long worked example) and the absence of an explicit scan-output validation step keep it just short of top marks.

Suggestions

Trim the opening subcommand table or the narrative worked example, since the modes are already enumerated in the description, to tighten conciseness.

Add an explicit validation checkpoint after 'snyk test' (e.g., inspect snyk.json findings count / non-zero exit handling) before applying the --severity-threshold gate, to strengthen workflow_clarity.

Consolidate the repeated 'Per [sn-gh]' sourcing cues to a single attribution to reduce token repetition.

DimensionReasoningScore

Conciseness

The body is command-first and efficient with brief inline comments, but the subcommand table repeats modes already in the description and the narrative worked example adds length that could be trimmed. Not 5 because not every token earns its place; not 3 because padding is minor rather than pervasive.

4 / 5

Actionability

Fully executable, copy-paste-ready commands ('npm install -g snyk', 'snyk test --severity-threshold=high', 'snyk monitor --org=my-org') plus a complete CI YAML cover the common cases. Not below 5 because guidance is concrete and complete, not pseudocode.

5 / 5

Workflow Clarity

A clear 6-step sequence pairs with a mandatory triage checkpoint ('must include an expires field') and a quarterly re-review feedback loop. Not 5 because there is no explicit output-validation command between scan and gate; not 3 because checkpoints (triage, re-review, anti-patterns) are present.

4 / 5

Progressive Disclosure

The body is an overview that pushes the heavy policy schema, justification template, suppression-layer table, and re-review cadence to a clearly signaled, one-level-deep reference (references/snyk-policy-and-triage.md, a real file). Not below 5 because the split is appropriate and navigation is easy.

5 / 5

Total

18

/

20

Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is concrete, complete, and well-differentiated, listing all scanner modes plus the .snyk policy workflow and an explicit Use-when clause with a disambiguation hint toward osv-scanner. Its only mild gap is trigger-term breadth, where a few natural phrasings and file extensions are absent.

DimensionReasoningScore

Specificity

Lists multiple specific concrete actions across all Snyk modes ('snyk test for SCA', 'snyk code test for SAST', 'snyk container test', 'snyk iac test', 'snyk monitor', 'policy file .snyk for ignore + patch'), giving comprehensive coverage. Not below 5 because coverage is broad and concrete rather than a few actions with minor gaps.

5 / 5

Completeness

Explicitly answers what ('Configures and runs Snyk, a commercial multi-mode scanner...') and when ('Use when the team has a Snyk license and needs SCA... or continuous vuln monitoring') with concrete trigger phrases. Not below 5 because both what and when are present and specific.

5 / 5

Trigger Term Quality

Good keyword coverage with synonyms ('SCA (dependency scanning)', 'SAST (code security scanning)', 'continuous new-vuln alerts', 'open-source scanning'); not 5 because it lacks common variations like explicit 'CVE'/'vulnerability' phrasing or file-extension triggers users might name.

4 / 5

Distinctiveness Conflict Risk

Clear commercial-Snyk niche with explicit disambiguation ('for open-source scanning without a Snyk license, prefer osv-scanner'), minimizing conflict risk with adjacent skills.

5 / 5

Total

19

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Reviewed

Table of Contents