Tessle

Tessl is an agent enablement platform for building AI-native software with structured, versioned context for coding agents. Its control plane includes a searchable registry for organizational and private skills, context-activation tracking, before-and-after evaluations, and checks for security and quality regressions. Tessl organizes agent workflows into loops, including automated code review, skill optimization, security scanning, documentation maintenance, model and agent evaluation, cost benchmarking, test-and-fix workflows, and incident postmortems. The platform also supports switching model providers through configuration and bringing a custom model for evaluation against real tasks. The video describes additional Tessl capabilities including Tessl Agent, Tessl Launch, governance for skills, and connectors linking issue trackers with GitHub workflows.

SkillSpector is an open-source security scanner for AI agent skills, developed by NVIDIA. It scans Git repositories, URLs, ZIP archives, directories, and individual skill files before installation, looking for prompt injection, data exfiltration, privilege escalation, supply-chain issues, dangerous code, MCP permission problems, tool poisoning, and other malicious patterns. Its two-stage pipeline combines static analysis—including regex, Python AST, taint tracking, YARA signatures, and OSV.dev dependency lookups—with optional LLM-based semantic evaluation. It produces terminal, JSON, Markdown, or SARIF reports containing findings, severity labels, a 0–100 risk score, and installation recommendations. Baselines can suppress accepted findings, and the CLI can be used in CI or install gates through exit codes and machine-readable output. SkillSpector can also run as an MCP server callable by compatible agents. It does not execute scanned skills or sandbox them; optional LLM analysis sends eligible file contents to the configured provider, while dependency checks query OSV.dev. The project is distributed under the Apache License 2.0 and is part of NVIDIA's Verified Skills pipeline.

Tessl Agent is Tessl’s agentic experience for creating and maintaining improvement loops in software factories. It mines pull requests and issues for repeated tasks that can be automated, and provides maintenance workflows such as scheduled scans for architecture quality, code duplication, test quality, and security vulnerabilities. Tessl describes its loops as workflows that read a team’s standard, perform the associated work, and improve as they run; the platform includes automated code review, security scanning, documentation maintenance, test-and-fix, model and agent evaluation, and cost benchmarking.

SkillRadar is open-source discovery, security, ranking, and routing infrastructure for Agent Skills and Codex. It discovers public SKILL.md files, parses their contents, performs conservative static checks for capabilities such as shell commands, dynamic execution, secret access, networking, package installation, filesystem writes, and deployment tooling, then classifies and ranks candidates in a safety-gated registry. D and Blocked candidates are kept audit-only and excluded from automatic routing. Its Codex plugin provides task-to-Top-3 routing, skill search, provenance and safety inspection, and a read-only Skill Budget Doctor. Routing can use a bundled offline registry and returns relevance, SkillRadar score, security grade, provenance, reasons, and match details without executing candidate repositories or depending on live GitHub discovery. The repository includes radar data, a matching system, a router-quality benchmark, a local registry UI, and daily bot-refreshed generated data; it is released under the MIT license.

security-audit is a Cloudflare coding-agent skill that orchestrates multi-phase security audits of codebases. It uses reconnaissance to map architecture, trust boundaries, input surfaces, prior evidence, and deterministic coverage; assigns isolated agents to coverage-led hunting; sends each unique candidate to a fresh verifier; and records confirmed, needs_validation, and rejected results in machine-readable findings.json validated against a report schema. Independent agents verify final source claims, after which the skill derives target-neutral reports and coverage records. It can be installed with the Skills CLI and requires a tool-using coding agent with parallel sub-agent support, Node.js for its validators, and an OS-enforced sandbox for target-controlled execution. The repository is licensed under MIT.