api-security-best-practices

Implement secure API design patterns including authentication, authorization, input validation, rate limiting, and protection against common API vulnerabilities

Quality

16%

Does it follow best practices?

Impact

—

No eval scenarios have been run

Securityby

Passed

No known issues

Fix and improve this skill with Tessl

tessl review fix ./.agent/skills/api-security-best-practices/SKILL.md

Quality

Content

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

This skill is essentially an unstructured table of contents with 30 links to sub-files, providing no inline actionable content, no code examples, no workflow guidance, and no validation steps. The sub-skill links have significant overlap and poor organization (e.g., 'Authentication & Authorization' appears twice, generic names like 'The Problem' and 'Implementation' lack context). Without any bundle files to back up the references, the skill provides almost no value on its own.

Suggestions

Add concrete, executable code examples inline for the most critical patterns (e.g., JWT authentication setup, input validation middleware, rate limiting configuration) so the skill is useful even without sub-files.

Consolidate the 30 sub-skills into 5-7 logically grouped sections with clear headings, eliminating duplicates like the two authentication entries and giving context-free names like 'The Problem' proper scoping.

Add a clear workflow sequence with validation checkpoints, e.g., '1. Implement auth → 2. Add input validation → 3. Configure rate limiting → 4. Run security tests → 5. Review checklist' with explicit verification at each step.

Remove the verbose 'When to Use This Skill' section and replace with a single-line scope statement; Claude doesn't need 8 bullet points explaining when API security is relevant.

Dimension	Reasoning	Score
Conciseness	The content is almost entirely a list of 30 sub-skill links with no substantive inline content. The 'When to Use This Skill' section is verbose and lists obvious scenarios Claude would already understand. The body adds very little actionable information per token spent.	1 / 3
Actionability	There is zero executable code, no concrete commands, no specific examples, and no inline guidance. The entire skill body is a table of contents pointing to sub-files, with no actionable content in the main file itself.	1 / 3
Workflow Clarity	There is no clear workflow sequence, no validation checkpoints, and no feedback loops. The numbered list appears to be a flat enumeration of sub-files rather than a coherent multi-step process—items like 'The Problem', 'The Solution', 'Do This', 'Don't Do This' are listed as standalone steps without logical sequencing.	1 / 3
Progressive Disclosure	While the skill attempts progressive disclosure by linking to 30 sub-files, the structure is deeply fragmented and poorly organized. There are 30 sub-skills with no grouping, overlapping topics (e.g., items 1 and 26 both cover authentication/authorization), and no bundle files were provided to verify the references exist. This is a disorganized index, not well-structured progressive disclosure.	1 / 3
	Total	4 / 12 Passed

Description

32%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description identifies a clear domain (secure API design) and lists several relevant sub-topics, but it reads more like a topic heading than an actionable skill description. It lacks a 'Use when...' clause, misses common trigger term variations (OAuth, JWT, CORS), and doesn't specify concrete outputs or deliverables.

Suggestions

Add an explicit 'Use when...' clause, e.g., 'Use when the user asks about API security, securing endpoints, adding authentication/authorization to APIs, or protecting against attacks like injection or broken access control.'

Include more natural trigger terms and variations users would say, such as 'OAuth', 'JWT', 'API keys', 'CORS', 'SQL injection', 'XSS', 'OWASP API Top 10', 'token-based auth'.

Specify concrete actions/outputs, e.g., 'Generates authentication middleware, writes input validation schemas, configures rate limiting rules, and adds security headers to API responses.'

Dimension	Reasoning	Score
Specificity	Lists several domain-specific actions (authentication, authorization, input validation, rate limiting, vulnerability protection) but they read more like a category list than concrete actions. It doesn't specify what concrete outputs or transformations are performed (e.g., 'generate middleware code', 'add JWT token validation').	2 / 3
Completeness	Describes what the skill does (implement secure API design patterns) but completely lacks a 'Use when...' clause or any explicit trigger guidance for when Claude should select this skill. Per rubric guidelines, missing 'Use when' caps completeness at 2, and the 'what' is also only moderately clear, warranting a 1.	1 / 3
Trigger Term Quality	Includes relevant terms like 'authentication', 'authorization', 'rate limiting', 'input validation', and 'API vulnerabilities' that users might mention, but misses common variations like 'OAuth', 'JWT', 'API keys', 'CORS', 'SQL injection', 'XSS', or 'API security'.	2 / 3
Distinctiveness Conflict Risk	The focus on 'secure API design patterns' is somewhat specific, but terms like 'authentication', 'authorization', and 'input validation' could easily overlap with general security skills, web development skills, or backend development skills.	2 / 3
	Total	7 / 12 Passed

Validation

90%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 10 / 11 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	10 / 11 Passed

Repository: Dokhacgiakhoa/antigravity-ide
Commit: c4a059b

Reviewed: 13 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.