feat: improve skill scores and add automated review

[rohan-tessl]

Hey @jie023 👋

I ran your skills through tessl skill review at work and found some targeted improvements. Here's the full before/after:

Skill	Before	After	Change
test-api-data-quality	52%	85%	+33%
test-api-security	52%	90%	+38%
test-api-performance	55%	90%	+35%
requirement-doc-template	56%	90%	+34%
test-function	57%	80%	+23%

This PR intentionally caps changes at five skills to keep it reviewable. The included GitHub Action workflow (see below) will surface Tessl feedback on future SKILL.md changes across the whole repo.

What changed in each skill

All five skills shared the same structural issues:

• Removed triple repetition — test scenarios, checklists, and execution flow sections all listed the same points; consolidated into a single actionable workflow
• Added concrete Playwright MCP code examples — actual tool invocation patterns with parameters instead of abstract descriptions
• Improved descriptions — expanded with specific actions, English trigger terms, and explicit "Use when..." clauses for better discoverability
• Removed basic concept explanations — HTTP method lists and testing definitions that the agent already knows
• Added validation checkpoints — explicit verification steps between workflow stages with error-handling guidance

Skill-specific improvements:

• test-api-data-quality: Added concrete read-write consistency examples with field-by-field comparison patterns
• test-api-security: Added actual SQL injection, XSS, and path traversal payloads with expected response validation
• test-api-performance: Replaced pseudocode with executable evaluate + fetch patterns for real browser-level concurrency testing
• requirement-doc-template: Transformed from a raw template dump into a guided 5-step workflow with completeness validation
• test-function: Added a complete login form test example covering positive, negative, and boundary cases

🤖 Automated Skill Review (GitHub Action)

This PR also adds .github/workflows/skill-review.yml — a lightweight GitHub Action that reviews skills automatically on future PRs.

How it works and why it helps

• What runs: On PRs that change any **/SKILL.md, the workflow runs tesslio/skill-review and posts one PR comment with Tessl scores and feedback (updated on new pushes).
• Zero extra accounts: Contributors do not need a Tessl login — only the repo's default GITHUB_TOKEN is used to post the comment.
• Non-blocking by default: The check is feedback-only with no surprise red CI. It won't fail your builds.
• Not a build replacement: This is purely review automation for skill markdown — it doesn't touch your build or compile pipeline.
• Optional quality gate: If you ever want to enforce a minimum score, just add with: fail-threshold: 70 to the workflow step.
• Why only five skills here: Capping manual edits keeps this PR reviewable. After merge, every future PR that touches SKILL.md gets automatic review comments, so the rest of the library improves incrementally.

---

Honest disclosure — I work at @tesslio where we build tooling around skills like these. Not a pitch - just saw room for improvement and wanted to contribute.

Want to self-improve your skills? Just point your agent (Claude Code, Codex, etc.) at this Tessl guide and ask it to optimize your skill. Ping me - @rohan-tessl - if you hit any snags.

Thanks in advance 🙏

[github-actions]

⚠️ This PR contains unsigned commits. To get your PR merged, please sign those commits (git rebase --exec 'git commit -S --amend --no-edit -n' @{upstream}) and force push them to this branch (git push --force-with-lease).

If you're new to commit signing, there are different ways to set it up:

Sign commits with gpg

Follow the steps below to set up commit signing with gpg:

1. Generate a GPG key
2. Add the GPG key to your GitHub account
3. Configure git to use your GPG key for commit signing

Sign commits with ssh-agent

Follow the steps below to set up commit signing with ssh-agent:

1. Generate an SSH key and add it to ssh-agent
2. Add the SSH key to your GitHub account
3. Configure git to use your SSH key for commit signing

Sign commits with 1Password

You can also sign commits using 1Password, which lets you sign commits with biometrics without the signing key leaving the local 1Password process.

Learn how to use 1Password to sign your commits.

[gemini-code-assist]

Code Review

This pull request standardizes and streamlines the documentation for various Tari Ootle development skills, including Aider, Amp, Antigravity, Claude Code, and GitHub Copilot. The changes include updating descriptions to be more comprehensive, simplifying key concept definitions, and removing redundant introductory text. Feedback across all files suggests restoring the safety guarantee description ('Cannot be copied or accidentally destroyed') for the Resource concept to ensure developers understand the fundamental asset safety principles of the platform.

[gemini-code-assist]

While simplifying the key concepts is good, removing the phrase 'Cannot be copied or accidentally destroyed' for Resource might omit a crucial piece of information. This is a fundamental principle of resource-oriented programming and is important for developers to understand the asset safety guarantees of the platform. I'd suggest re-adding it for clarity.

Suggested change

	- **Resource** — Native digital asset (fungible token or NFT). Created with `ResourceBuilder`.
	- **Resource** — Native digital asset (fungible token or NFT). Created with `ResourceBuilder`. Cannot be copied or accidentally destroyed.

[gemini-code-assist]

While simplifying the key concepts is good, removing the phrase 'Cannot be copied or accidentally destroyed' for Resource might omit a crucial piece of information. This is a fundamental principle of resource-oriented programming and is important for developers to understand the asset safety guarantees of the platform. I'd suggest re-adding it for clarity.

Suggested change

	- **Resource** — Native digital asset (fungible token or NFT). Created with `ResourceBuilder`.
	- **Resource** — Native digital asset (fungible token or NFT). Created with `ResourceBuilder`. Cannot be copied or accidentally destroyed.

[gemini-code-assist]

While simplifying the key concepts is good, removing the phrase 'Cannot be copied or accidentally destroyed' for Resource might omit a crucial piece of information. This is a fundamental principle of resource-oriented programming and is important for developers to understand the asset safety guarantees of the platform. I'd suggest re-adding it for clarity.

Suggested change

	- **Resource** — Native digital asset (fungible token or NFT). Created with `ResourceBuilder`.
	- **Resource** — Native digital asset (fungible token or NFT). Created with `ResourceBuilder`. Cannot be copied or accidentally destroyed.

[gemini-code-assist]

While simplifying the key concepts is good, removing the phrase 'Cannot be copied or accidentally destroyed' for Resource might omit a crucial piece of information. This is a fundamental principle of resource-oriented programming and is important for developers to understand the asset safety guarantees of the platform. I'd suggest re-adding it for clarity.

Suggested change

	- **Resource** — Native digital asset (fungible token or NFT). Created with `ResourceBuilder`.
	- **Resource** — Native digital asset (fungible token or NFT). Created with `ResourceBuilder`. Cannot be copied or accidentally destroyed.

[gemini-code-assist]

While simplifying the key concepts is good, removing the phrase 'Cannot be copied or accidentally destroyed' for Resource might omit a crucial piece of information. This is a fundamental principle of resource-oriented programming and is important for developers to understand the asset safety guarantees of the platform. I'd suggest re-adding it for clarity.

Suggested change

	- **Resource** — Native digital asset (fungible token or NFT). Created with `ResourceBuilder`.
	- **Resource** — Native digital asset (fungible token or NFT). Created with `ResourceBuilder`. Cannot be copied or accidentally destroyed.