angular-security

Harden Angular apps against XSS, CSP violations, and unauthorized access. Use when implementing XSS protection, Content Security Policy, or auth guards in Angular.

Quality

65%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/angular/angular-security/SKILL.md

Quality

Content

43%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a well-organized security reference with concrete API names, but it lacks an executable workflow with validation checkpoints and repeats a few rules across sections. A broken second reference ('common/security-standards') weakens navigation.

Suggestions

Remove the dangling 'common/security-standards' reference or create the corresponding file so both References entries resolve to real bundle files.

Consolidate the secrets/API-keys guidance into a single location to eliminate the triple restatement across Principles, Anti-Patterns, and the checklist.

Add a short sequenced workflow with an explicit validation checkpoint (e.g., audit trust-marking calls -> verify CSP headers -> confirm HttpOnly cookies) so the skill reads as a process rather than only principles.

Dimension	Reasoning	Score
Conciseness	Mostly efficient with terse bullets and bold emphasis, but the 'Secrets' rule is restated three times (Principles, Anti-Patterns, and the CSP/secret checklist) and 'NOT use innerHTML' phrasing adds padding that could be tightened.	3 / 5
Actionability	Names concrete APIs (DomSanitizer.sanitize(SecurityContext.HTML, content), CanActivateFn, inject(Router).createUrlTree(['/login']), canActivate: [authGuard]) but the body provides only fragments rather than complete, copy-paste executable blocks; the working example lives in the reference file.	3 / 5
Workflow Clarity	This is a principles/anti-patterns reference rather than a sequenced process; there is no multi-step workflow and no validation checkpoints, and the closing checklist is a flat list, not a sequenced flow with feedback loops.	2 / 5
Progressive Disclosure	Sections are organized and one reference (references/security-best-practices.md) resolves to a real one-level-deep file, but 'common/security-standards' is a dangling reference with no corresponding bundle file or directory, muddying navigation.	3 / 5
	Total	11 / 20 Passed

Description

87%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that clearly states both capability and explicit 'Use when' triggers scoped to Angular security. Minor room to expand concrete action coverage, but it cleanly answers what and when.

Dimension	Reasoning	Score
Specificity	Names the Angular security domain and several concrete threat areas ('XSS, CSP violations, and unauthorized access'), though the actions are framed as hardening goals rather than an exhaustive action list, leaving minor coverage gaps.	4 / 5
Completeness	Explicitly answers both what ('Harden Angular apps against XSS, CSP violations, and unauthorized access') and when ('Use when implementing XSS protection, Content Security Policy, or auth guards in Angular') with concrete trigger phrases.	5 / 5
Trigger Term Quality	Includes natural trigger terms users would say ('XSS protection', 'Content Security Policy', 'auth guards') plus a keyword list (DomSanitizer, innerHTML, CSP, route guard); a few common synonyms are absent.	4 / 5
Distinctiveness Conflict Risk	Scoped tightly to Angular security with domain-specific triggers (Angular auth guards, Angular CSP, DomSanitizer), giving a clear niche with minimal overlap risk against other skills.	5 / 5
	Total	18 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
metadata_field	'metadata' should map string keys to string values	Warning

	Total	14 / 16 Passed

Repository: HoangNguyen0403/agent-skills-standard
Path: skills/angular/angular-security/SKILL.md
Commit: 405cdd5

Reviewed: 4 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.