CtrlK
BlogDocsLog inGet started
Tessl Logo

giuseppe-trisciuoglio/developer-kit

Comprehensive developer toolkit providing reusable skills for Java/Spring Boot, TypeScript/NestJS/React/Next.js, Python, PHP, AWS CloudFormation, AI/RAG, DevOps, and more.

89

Quality

89%

Does it follow best practices?

Impact

Pending

No eval scenarios have been run

SecuritybySnyk

Risky

Do not use without reviewing

Overview
Quality
Evals
Security
Files

Quality

Discovery

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

This is a strong skill description that clearly identifies its niche (unit testing Spring Security annotations), lists specific capabilities, includes natural trigger terms developers would use, and provides an explicit 'Use when' clause. The specific annotation names (@PreAuthorize, @Secured, @RolesAllowed) make it highly distinctive and easy for Claude to match to the right user requests.

DimensionReasoningScore

Specificity

Lists specific concrete actions: testing with specific annotations (@PreAuthorize, @Secured, @RolesAllowed), validating role-based access control, and validating authorization policies. The mention of specific annotations adds strong concreteness.

3 / 3

Completeness

Clearly answers both 'what' (provides patterns for unit testing Spring Security annotations, validates RBAC and authorization policies) and 'when' (explicit 'Use when testing security configurations and access control logic').

3 / 3

Trigger Term Quality

Includes strong natural keywords users would say: 'unit testing', 'Spring Security', '@PreAuthorize', '@Secured', '@RolesAllowed', 'role-based access control', 'authorization', 'security configurations', 'access control logic'. These cover the terms a developer would naturally use.

3 / 3

Distinctiveness Conflict Risk

Highly distinctive niche: specifically targets unit testing of Spring Security annotations. The combination of 'Spring Security', specific annotation names, and 'unit testing' makes it very unlikely to conflict with other skills.

3 / 3

Total

12

/

12

Passed

Implementation

57%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The skill is highly actionable with executable code examples and good progressive disclosure to reference files. However, it suffers from significant verbosity — repeating the same code patterns, explaining concepts Claude already knows (what @PreAuthorize does, what RBAC is), and including generic best practices and pitfalls lists. The content could be cut by 40-50% without losing any actionable information.

Suggestions

Remove the 'Overview', 'When to Use', and 'Quick Reference' sections — Claude already knows what these annotations do and when to test security

Eliminate the duplicate deleteUser examples; the pattern appears in both Instructions (Step 3) and Examples sections with nearly identical code

Consolidate 'Best Practices', 'Common Pitfalls', and 'Constraints and Warnings' into a single concise 'Key constraints' section focusing only on non-obvious gotchas (proxy bypass, ROLE_ prefix, thread-local context)

DimensionReasoningScore

Conciseness

Significant verbosity throughout. The 'Overview' and 'When to Use' sections explain concepts Claude already knows. The 'Best Practices' and 'Common Pitfalls' sections are generic advice that Claude would already understand. The 'Quick Reference' table explains what @PreAuthorize and @Secured do, which is unnecessary. The same code patterns (deleteUser with ADMIN/USER roles) are repeated multiple times across Instructions and Examples sections.

1 / 3

Actionability

The skill provides fully executable Java code examples with proper imports, annotations, and assertions. The dependency setup, configuration class, and test patterns are all copy-paste ready with concrete examples using @WithMockUser, UsernamePasswordAuthenticationToken, and AssertJ assertions.

3 / 3

Workflow Clarity

Steps are numbered and sequenced (1-5), and there is a validation step (Step 5) to verify security is active. However, the validation tip about @EnableMethodSecurity being silently bypassed is buried in a blockquote rather than being a prominent checkpoint in the workflow. The feedback loop for 'tests pass unexpectedly' could be more explicit.

2 / 3

Progressive Disclosure

Clear one-level-deep references to setup.md, basic-testing.md, advanced-authorization.md, and complete-examples.md. The main skill provides a good overview with inline examples while pointing to detailed materials for advanced topics. References are well-organized by category (Setup, Testing Patterns, Advanced Topics, Complete Examples).

3 / 3

Total

9

/

12

Passed

Validation

90%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation10 / 11 Passed

Validation for skill structure

CriteriaDescriptionResult

allowed_tools_field

'allowed-tools' contains unusual tool name(s)

Warning

Total

10

/

11

Passed

Reviewed

Table of Contents