feat: improve audit-dependencies skill score (67% → 83%)

[yogesh-tessl]

Hey @pittolive 👋

this is really well put together. The 3 focused skills for dependency auditing, checking, and finding safer versions map directly to what developers actually need from Sonatype. No fluff, just useful functionality. The multi-platform setup with a Cursor plugin, MCP config, and agents directory is a great touch too; it shows you’re thinking about how developers actually work and making it easy to plug into their existing tools.

ran your skills through tessl skill review at work and found some targeted improvements for audit-dependencies. Here's the before/after:

Skill	Before	After	Change
audit-dependencies	67%	83%	+16%

I focused on audit-dependencies since it had the most room to grow and it's the skill users hit first when they want a full project-wide scan.

What changed

• Expanded description with explicit trigger terms - added a Use when... clause covering natural user phrasings like "CVE scan", "supply chain security", "outdated packages", and specific manifest file names (package.json, pom.xml, requirements.txt, etc.). This helps the agent match the skill to a wider range of user requests.
• Added PURL construction formats - documented Package URL patterns for all six supported ecosystems (npm, Maven, PyPI, Go, Cargo, Gem) so the agent can build PURLs correctly without guessing.
• Added concrete MCP tool invocation syntax - showed the exact getComponentVersion call with parameters, making the workflow copy-paste actionable.
• Added error handling guidance - step 4 now handles missing PURL data gracefully instead of failing silently.
• Trimmed the example output - cut from 38 lines to 21 while keeping the essential format (severity table + critical findings + next-step prompt).
• Added cross-skill reference - the example now suggests /find-safer-version as a follow-up, connecting the audit flow to the upgrade flow.

---

quick honest disclosure. I work at https://github.com/tesslio where we build tooling around skills like these. Not a pitch, just saw room for improvement and wanted to contribute.

if you want to self-improve your skills, or define your own scenarios to pressure test, just ask your agent (Claude Code, Codex, etc.) to evaluate and optimize your skill with Tessl. Ping me @yogesh-tessl, if you hit any snags.

[yogesh-tessl]

hey @pittolive 👋, just a friendly follow-up in case this got buried, happy to help move it forward!
Totally fine if there's a process, just wanted to keep it visible.