CtrlK
BlogDocsLog inGet started
Tessl Logo

giuseppe-trisciuoglio/developer-kit

Comprehensive developer toolkit providing reusable skills for Java/Spring Boot, TypeScript/NestJS/React/Next.js, Python, PHP, AWS CloudFormation, AI/RAG, DevOps, and more.

89

Quality

89%

Does it follow best practices?

Impact

Pending

No eval scenarios have been run

SecuritybySnyk

Risky

Do not use without reviewing

Overview
Quality
Evals
Security
Files

Quality

Discovery

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

This is an excellent skill description that clearly defines its scope (TypeScript/Node.js security review), lists specific vulnerability categories it checks for, names target frameworks, and provides explicit trigger guidance. It uses proper third-person voice throughout and balances comprehensiveness with conciseness. The description would allow Claude to confidently select this skill from a large pool without ambiguity.

DimensionReasoningScore

Specificity

Lists multiple specific concrete actions: validates against XSS, injection, CSRF, JWT/OAuth2 flaws, dependency CVEs, and secrets exposure. Also names specific frameworks (Express, NestJS, Next.js) and standards (OWASP).

3 / 3

Completeness

Clearly answers both 'what' (security review for TypeScript/Node.js apps, validates against specific vulnerability classes) and 'when' (explicit 'Use when' clause covering security audits, pre-deployment, auth review, OWASP compliance, plus explicit trigger phrases).

3 / 3

Trigger Term Quality

Includes strong natural trigger terms like 'security review', 'check for security issues', 'TypeScript security audit', plus domain-specific terms users would naturally mention like 'XSS', 'injection', 'CSRF', 'OWASP compliance', 'authentication/authorization', and 'before deployment'.

3 / 3

Distinctiveness Conflict Risk

Highly distinctive with a clear niche: security review specifically for TypeScript/Node.js with named frameworks and specific vulnerability categories. Unlikely to conflict with general code review or non-security skills.

3 / 3

Total

12

/

12

Passed

Implementation

85%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

This is a strong, well-structured security review skill with excellent workflow clarity, actionable code examples, and good progressive disclosure through reference files. Its main weakness is moderate verbosity — the 'When to Use' list, 'Best Practices' section, and 'Constraints and Warnings' section contain information Claude already knows or could infer, consuming tokens without adding proportional value. The core workflow with checkpoints and feedback loops is exemplary.

Suggestions

Trim the 'When to Use' section to 3-4 key triggers instead of 10 — Claude can infer related scenarios

Condense or remove the 'Best Practices' section since most items (parameterized queries, bcrypt for passwords, HttpOnly cookies) are well-known security fundamentals that Claude already knows, and they're already covered in the workflow steps

DimensionReasoningScore

Conciseness

The skill is fairly comprehensive but includes some unnecessary verbosity. The 'When to Use' section is overly detailed (Claude can infer most triggers), the 'Best Practices' section largely restates well-known security principles Claude already knows, and some checkpoint descriptions are repetitive. However, the code examples and workflow steps earn their place.

2 / 3

Actionability

The skill provides fully executable TypeScript code examples for JWT security and SQL injection prevention, specific grep commands for scanning, concrete tool references (npm audit, DOMPurify, helmet.js, Zod/Joi), and a structured output format. The before/after code patterns are copy-paste ready and clearly illustrate the vulnerability and fix.

3 / 3

Workflow Clarity

The 9-step workflow is clearly sequenced with explicit checkpoints after each step (e.g., 'Verify at least 3 security-sensitive files identified before proceeding'), includes specific grep commands for validation, and has a feedback loop in step 9 for re-scanning when critical vulnerabilities are found. The progression from scope identification through scanning to report generation is logical and well-structured.

3 / 3

Progressive Disclosure

The skill provides a clear overview with well-signaled one-level-deep references to 6 specific files in the references/ directory. The main content stays focused on the workflow and key examples, while detailed patterns for XSS, security headers, OWASP mappings, etc. are appropriately delegated to separate reference files.

3 / 3

Total

11

/

12

Passed

Validation

90%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation10 / 11 Passed

Validation for skill structure

CriteriaDescriptionResult

allowed_tools_field

'allowed-tools' contains unusual tool name(s)

Warning

Total

10

/

11

Passed

Reviewed

Table of Contents