common-security-standards

Enforce universal security protocols for safe, resilient software. Use when implementing authentication, encryption, authorization, input validation, secret management, or any security-sensitive feature across any language or framework.

Quality

71%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./.github/skills/common/common-security-standards/SKILL.md

Quality

Content

68%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is well-structured with concise, actionable security rules and a clear workflow, supported by real reference files. The main gaps are a missing failure/feedback loop in the verification step and a slightly nested reference chain.

Suggestions

Add an explicit feedback loop to the Workflow's verify step (e.g., 'If SAST/DAST finds issues, fix and re-run before merge').

Flatten the reference chain so INJECTION_TESTING.md does not point onward to VULNERABILITY_REMEDIATION.md, or surface both directly from SKILL.md.

Inline one short executable code snippet (e.g., a parameterized query) in the body so core guidance does not depend on opening a reference.

Dimension	Reasoning	Score
Conciseness	The body is mostly lean bullet lists that assume Claude's competence, with only minor redundancy (Zero Trust and Least Privilege appear in both Always-Apply Rules and Context-Specific Rules).	4 / 5
Actionability	Concrete directives like 'AES-256 for data-at-rest; TLS 1.3 for data-in-transit', 'WHERE id = ${userId} always wrong', and 'npm audit, pip audit' give executable guidance, though executable code lives in references rather than the body.	4 / 5
Workflow Clarity	The numbered Workflow (Identify trust boundaries, Validate, Apply least privilege, Verify with SAST/DAST) has a sequence and a verification step, but no explicit feedback loop for what to do when scans fail.	3 / 5
Progressive Disclosure	References are one-level deep and clearly signaled with all three files (implementation.md, INJECTION_TESTING.md, VULNERABILITY_REMEDIATION.md) present and linked, though INJECTION_TESTING.md links onward to VULNERABILITY_REMEDIATION.md, creating a mild 2-level chain.	4 / 5
	Total	15 / 20 Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description clearly and explicitly states both what the skill does and when to use it, with strong trigger-term coverage. Its main weakness is breadth — claiming universality across any language/framework raises overlap risk with more specialized security skills.

Suggestions

Narrow the scope claim from 'any security-sensitive feature across any language or framework' to a defined niche to reduce overlap with specialized security skills.

Replace the abstract verb 'Enforce universal security protocols' with 2-3 concrete actions (e.g., 'Review code for injection flaws, verify secret handling, and check auth/encryption patterns').

Dimension	Reasoning	Score
Specificity	The single verb 'Enforce universal security protocols' is abstract, but the enumerated domains (authentication, encryption, authorization, input validation, secret management) name concrete security areas rather than describing multiple distinct actions.	3 / 5
Completeness	It explicitly answers both what ('Enforce universal security protocols for safe, resilient software') and when ('Use when implementing authentication, encryption, authorization, input validation, secret management, or any security-sensitive feature').	5 / 5
Trigger Term Quality	Natural keywords like 'authentication', 'encryption', 'authorization', 'input validation', and 'secret management' are terms users actually say, though a few synonyms and file/extension variants are missing.	4 / 5
Distinctiveness Conflict Risk	The scope 'any security-sensitive feature across any language or framework' is very broad and would overlap with many narrower security skills, though the enumerated triggers add some specificity.	3 / 5
	Total	15 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
metadata_field	'metadata' should map string keys to string values	Warning

	Total	14 / 16 Passed

Repository: HoangNguyen0403/agent-skills-standard
Path: .github/skills/common/common-security-standards/SKILL.md
Commit: 405cdd5

Reviewed: 4 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.