CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

devtools-unicode-escaping

Guidelines for escaping strings and handling user-controlled data in DevTools to prevent layout bleed-through, XSS, and security issues.

Quality

71%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./.agents/skills/devtools-unicode-escaping/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

75%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a compact, well-structured decision guide with concrete function names, file paths, and executable examples covering all four rendering contexts. Its main weaknesses are the missing code example for safeEscapeUnicode, slight restatement of behavior across sections, and the absence of a one-line decision rule for choosing between the two helpers.

Suggestions

Replace section 2's prose 'Example Usage' with an actual code snippet showing safeEscapeUnicode applied to a user-controlled string in a template context.

Add a one-line decision rule near the top (e.g. 'escapeUnicodeAsText = show hidden chars as literal \uXXXX; safeEscapeUnicode = keep safe zero-width chars, escape bidi overrides') so the helper choice is immediate.

Trim the restated safeEscapeUnicode guidance in section 4 (it duplicates section 2's behavior bullets) to remove redundancy.

DimensionReasoningScore

Conciseness

The body is lean and assumes competence — it documents only the DevTools-specific helpers and their behaviors without padding — but the safeEscapeUnicode behavior in section 2 is partially restated in section 4 and 'Behavior' bullets repeat what inline examples show, so it is efficient with minor trims rather than every-token-earns-its-place.

4 / 5

Actionability

Guidance is mostly executable: concrete function names ('Platform.StringUtilities.escapeUnicodeAsText', 'safeEscapeUnicode'), a real file path ('front_end/ui/lit/strip-whitespace.ts'), and copy-paste snippets. Gaps keep it from 5: section 2's 'Example Usage' is prose ('Used automatically by the global Lit template wrapper') rather than code, and the Lit example is a single inline expression without imports or template context.

4 / 5

Workflow Clarity

The selection guidance is clearly conditioned per rendering context (inspect-as-text vs template rendering vs automatic Lit wrapper vs manual DOM assignments) and the directives rule is unambiguous, so the sequence of decisions is clear; it falls short of 5 because there is no single decision rule or checklist up front summarizing which helper applies, and the boundary between section 1 and 2 contexts must be assembled by the reader.

4 / 5

Progressive Disclosure

The content is well organized into four clearly headed sections with everything appropriately inline for a single-topic guideline skill, and no buried or nested references exist. It does not fully meet the simple-skill exception (body is ~60 lines, just over the under-50-lines threshold), so 'good structure, appropriately placed' at 4 is the best fit.

4 / 5

Total

16

/

20

Passed

Description

53%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific to a clear DevTools niche and names its purpose well, but it lacks an explicit 'Use when...' trigger clause and misses natural trigger-term variations like 'unicode', 'sanitize', or 'RTL'. Adding a trigger clause and naming the two escaping functions would lift completeness and trigger quality.

Suggestions

Add an explicit trigger clause, e.g. 'Use when rendering user-controlled or untrusted strings in the DevTools UI (console messages, object properties, DOM tree nodes, titles), or when the user mentions unicode escaping, XSS, or RTL/bidi leaks.'

Name the concrete capabilities (e.g. 'escape unicode as text via escapeUnicodeAsText, safely escape layout-critical characters via safeEscapeUnicode') so the 'what' lists several specific actions.

Include natural synonyms such as 'sanitize', 'unicode', 'bidi', and 'RTL' so the description matches how users actually phrase the need.

DimensionReasoningScore

Specificity

The description names the domain ('escaping strings and handling user-controlled data in DevTools') and one or two concrete actions with prevention targets ('layout bleed-through, XSS'), but does not list several specific actions, so it matches the 1-2-concrete-actions anchor rather than the several-actions anchor.

3 / 5

Completeness

The 'what' is clear (guidelines for escaping strings and handling user-controlled data), but there is no 'Use when...' clause or equivalent explicit trigger guidance — usage context is only weakly implied by 'in DevTools' — which caps completeness at 3.

3 / 5

Trigger Term Quality

It includes some relevant keywords ('DevTools', 'XSS', 'escaping strings', 'user-controlled data'), but misses common natural variations a developer would say such as 'unicode', 'sanitize', 'bidi', 'RTL', or 'escape sequences', fitting the 'some relevant keywords but missing variations' anchor.

3 / 5

Distinctiveness Conflict Risk

'in DevTools to prevent layout bleed-through, XSS' carves a distinct niche that is unlikely to trigger competing skills, but it retains minor overlap risk with generic security/XSS-escaping skills, placing it between the 'mostly distinct' and 'clear niche' anchors.

4 / 5

Total

13

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

ChromeDevTools/devtools-frontend

Path

.agents/skills/devtools-unicode-escaping/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.