security

Secure coding practices for agent-native apps: input validation, SQL injection, XSS, secrets, data scoping, and auth. Use when writing any action, route, or component that touches user data or external input.

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

77%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-structured security reference with executable code, a numbered route-handling workflow, and a checklist. Its weak spots are conciseness (inline historical anecdotes and a date outside any deprecated section) and progressive disclosure (a long monolithic file with no reference files).

Suggestions

Move the historical "On 2026-04-29 ..." context and the Brent/Zoom anecdotes into a brief 'Background / why these guards exist' or deprecated-patterns section so the main rules stay lean.

Split the lengthy Guards and Data Scoping detail into a reference file (e.g. GUARDS.md) referenced one level deep from SKILL.md, keeping the body as a concise overview.

Tighten prose-heavy paragraphs (e.g. the localhost-fallback and ambient-identity guard descriptions) into bullet rules with the opt-out marker syntax, reducing narrative padding.

Dimension	Reasoning	Score
Conciseness	Mostly dense and actionable, but the inline date "On 2026-04-29 ..." and narrative anecdotes ("Brent's signup leaked ...", "most recently the Zoom webhook") are historical context that could be tightened or moved to a deprecated/old-patterns section.	2 / 3
Actionability	Provides fully executable TypeScript (defineAction+Zod, Drizzle/parameterized SQL, ssrfSafeFetch, resolveCredential, accessFilter, needsApproval) plus concrete commands (pnpm action db-check-scoping, pnpm prep) and named guard scripts — copy-paste ready.	3 / 3
Workflow Clarity	The custom-routes section is a precise 3-step sequence, CI guards provide automated validation feedback, and a closing Checklist gives explicit verification checkpoints for the complex process.	3 / 3
Progressive Disclosure	Well-organized into clear headered sections, but the ~270-line body is monolithic with all detail inline and no bundle/reference files to split deeper material (e.g. the Guards detail) one level deep.	2 / 3
	Total	10 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description: third-person, concrete capability list, and an explicit "Use when" trigger covering both what and when. It is concise without padding and uses natural trigger terms.

Dimension	Reasoning	Score
Specificity	Lists six concrete, specific capability areas — "input validation, SQL injection, XSS, secrets, data scoping, and auth" — rather than vague language, matching the multiple-specific-actions anchor.	3 / 3
Completeness	Clearly states what ("Secure coding practices for agent-native apps: ...") and when via an explicit "Use when ..." clause, satisfying both halves with an explicit trigger.	3 / 3
Trigger Term Quality	Natural developer-facing triggers abound: "writing any action, route, or component that touches user data or external input" plus named terms like "SQL injection", "XSS", "secrets", and "auth" that users would actually say.	3 / 3
Distinctiveness Conflict Risk	The "agent-native apps" niche plus the data/external-input trigger carves a clear, distinct scope unlikely to fire for unrelated skills.	3 / 3
	Total	12 / 12 Passed

Validation

75%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 12 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
metadata_field	'metadata' should map string keys to string values	Warning
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning
referenced_paths_exist	Referenced path issues: 5 missing	Warning

	Total	12 / 16 Passed

Repository: BuilderIO/agent-native
Path: .agents/skills/security/SKILL.md
Commit: e9a2f0e

Reviewed: 5 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.