security

Secure coding practices for agent-native apps: input validation, SQL injection, XSS, secrets, data scoping, and auth. Use when writing any action, route, or component that touches user data or external input.

Quality

77%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./.agents/skills/security/SKILL.md

Quality

Content

71%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable security reference with excellent executable code examples, clear access-control sequencing, and CI-backed validation checkpoints. Its main weaknesses are a monolithic, over-long body with inline time-sensitive history that should be split into reference files or a deprecation section.

Suggestions

Move the historical cross-tenant-leak context (the 2026-04-29 narrative and detailed guard-script internals) into an 'Old patterns / deprecated' or separate reference file so time-sensitive information doesn't bloat the core rules.

Extract the long 'Same-Origin Workspace Apps' and per-guard opt-out detail into a references/ file, keeping SKILL.md as a concise overview with one-level-deep pointers, to improve progressive disclosure.

Tighten prose in the guards and credentials sections by leading with the rule and the minimal code snippet, then linking to details rather than narrating the bug class inline.

Dimension	Reasoning	Score
Conciseness	Most content is genuinely framework-specific (guard scripts, ssrfSafeFetch, accessFilter) and earns its place, but inline time-sensitive history ('On 2026-04-29...', '2026-04 cross-tenant leak class') and lengthy guard-script prose are not isolated in a deprecation/old-patterns section, and several sections could be tightened.	3 / 5
Actionability	Multiple copy-paste-ready TypeScript snippets with imports (defineAction+Zod, Drizzle/parameterized SQL, ssrfSafeFetch, resolveCredential, accessFilter, authorize, needsApproval) cover the common cases with fully executable guidance.	5 / 5
Workflow Clarity	The custom-route section gives a clear numbered 1-2-3 sequence, CI guards and db-check-scoping provide validation checkpoints, and a closing Checklist verifies the rules; most of the skill is a rules catalog rather than a sequenced workflow, so it stops short of the explicit validate-fix-retry loops at 5.	4 / 5
Progressive Disclosure	Good section headers organize the content and related skills are signaled at the end, but no bundle files exist and substantial content that could live in separate references (Same-Origin Workspace Apps deep-dive, detailed guard-script internals, historical credential-leak context) is inlined in a single ~340-line file.	3 / 5
	Total	15 / 20 Passed

Description

83%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that clearly states what the skill covers and when to use it, with concrete security-domain keywords and explicit trigger guidance. Minor overlap with the authentication skill and topic-list (vs action-list) phrasing keep it just below the top anchor on two dimensions.

Dimension	Reasoning	Score
Specificity	Lists six concrete security domains ('input validation, SQL injection, XSS, secrets, data scoping, and auth'), giving specific coverage rather than vague abstraction, but these are topic areas rather than verb-form actions so it stops short of the comprehensive action list at 5.	4 / 5
Completeness	Explicitly answers both 'what' (secure coding practices for agent-native apps with a concrete area list) and 'when' ('Use when writing any action, route, or component that touches user data or external input') with concrete trigger phrases.	5 / 5
Trigger Term Quality	Natural developer terms like 'SQL injection', 'XSS', 'secrets', and 'input validation' plus triggers ('any action, route, or component that touches user data or external input') give good keyword coverage, though a few common synonyms (sanitization, CSRF, .env) are absent.	4 / 5
Distinctiveness Conflict Risk	'Secure coding practices for agent-native apps' is a clear niche with distinct triggers, but the inclusion of 'auth' creates minor overlap with the dedicated authentication skill referenced in the body.	4 / 5
	Total	17 / 20 Passed

Validation

75%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 12 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
metadata_field	'metadata' should map string keys to string values	Warning
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning
referenced_paths_exist	Referenced path issues: 5 missing	Warning

	Total	12 / 16 Passed

Repository: BuilderIO/agent-native
Path: .agents/skills/security/SKILL.md
Commit: b0df876

Reviewed: 1 day ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.