We Scored a Real Snyk Skill Against Anthropic's Rules
Summary
This video details a live review process where a Snyk skill (`SKILL.md`) was evaluated using Tessl's `tessl review run` against Anthropic's best practices. The initial score of 87% was successfully improved to 90% by applying fixes, demonstrating how automated tools can enhance skill quality and security. Key focus areas include implementing progressive disclosure to prevent context bloat, improving skill conciseness, and using Snyk's Agent Scan tool to detect vulnerabilities like prompt injection in both first-party and third-party skills.
Key takeaways
-
Skill Quality Improvement via Automated Review
The review process successfully increased the skill score from 87% to 90% by applying fixes, demonstrating that automated tools can significantly improve adherence to best practices (e.g., Anthropic's guidelines).
-
Importance of Progressive Disclosure
10:08
Skills should not be overly dense or verbose. Implementing progressive disclosure—breaking large skills into smaller, referenced sub-files—prevents context bloat and ensures the agent only loads necessary information.
-
Security Scanning with Agent Scan
Snyk's dedicated tool, Agent Scan (available on GitHub), can scan skills for security vulnerabilities, including prompt injection, which is crucial when integrating third-party or user-written skills.
Technical details
-
Skill Evaluation Workflow
428s
The process involves running `tessl review run` on a skill (e.g., Snyk API target configuration). This runs an agent review, treating the LLM as a judge against established best practices to score and suggest improvements for the `SKILL.md`.
-
Skill Standardization
While many skills are initially personal, organizations can standardize them by having platform teams publish core skills (e.g., a skill for pushing to production) that must pass rigorous security and quality checks.
-
Skill Vulnerabilities
Poorly written skills can introduce potential security issues, such as prompt injection. The review process helps identify these weaknesses in both first-party and third-party code.
Mentioned resources
Channel & topics
Watch on YouTube · Back to latest
This independent, AI-assisted summary is provided for commentary and informational purposes. It may contain errors or omit important context. Please watch the original video for the creator's complete presentation. Video, thumbnail, and related copyrights belong to their respective owners.