# We Scored a Real Snyk Skill Against Anthropic's Rules

## Executive summary

This video details a live review process where a Snyk skill (`SKILL.md`) was evaluated using Tessl's `tessl review run` against Anthropic's best practices. The initial score of 87% was successfully improved to 90% by applying fixes, demonstrating how automated tools can enhance skill quality and security. Key focus areas include implementing progressive disclosure to prevent context bloat, improving skill conciseness, and using Snyk's Agent Scan tool to detect vulnerabilities like prompt injection in both first-party and third-party skills.

## Key takeaways

- Skill Quality Improvement via Automated Review: The review process successfully increased the skill score from 87% to 90% by applying fixes, demonstrating that automated tools can significantly improve adherence to best practices (e.g., Anthropic's guidelines).
- Importance of Progressive Disclosure: Skills should not be overly dense or verbose. Implementing progressive disclosure—breaking large skills into smaller, referenced sub-files—prevents context bloat and ensures the agent only loads necessary information.
- Security Scanning with Agent Scan: Snyk's dedicated tool, Agent Scan (available on GitHub), can scan skills for security vulnerabilities, including prompt injection, which is crucial when integrating third-party or user-written skills.

## Technical details

- Skill Evaluation Workflow: The process involves running `tessl review run` on a skill (e.g., Snyk API target configuration). This runs an agent review, treating the LLM as a judge against established best practices to score and suggest improvements for the `SKILL.md`.
- Skill Standardization: While many skills are initially personal, organizations can standardize them by having platform teams publish core skills (e.g., a skill for pushing to production) that must pass rigorous security and quality checks.
- Skill Vulnerabilities: Poorly written skills can introduce potential security issues, such as prompt injection. The review process helps identify these weaknesses in both first-party and third-party code.

## Practical implications

- Integrate skill review checks into CI/CD pipelines (e.g., running the review on pull requests) to prevent regressions and ensure adherence to best practices before deployment.
- Adopt progressive disclosure principles when designing complex automation skills, breaking them into modular, referenced files to maintain conciseness and reduce context bloat for LLMs.
- Mandate security scanning (like Agent Scan) for all third-party or user-contributed skills to mitigate risks like prompt injection.

## Topics

Build Engineering, AI Development, Skill Automation, Security Scanning, Progressive Disclosure, CI/CD Quality Gates, Tessl, Snyk Agent Scan

Source: https://www.youtube.com/watch?v=uS7QLgj1jUY