Content
75%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A lean, actionable security checklist with concrete library guidance, a verification step, and an appropriate single-level reference split. Main weaknesses are inline-only code fragments (no complete examples in the body), a duplicated reference pointer, and dangling links inside REFERENCE.md.
Suggestions
Deduplicate the references/REFERENCE.md pointer: keep one clearly labeled References section instead of repeating the same link under 'Validate Input at Boundaries' and 'References'.
Add one complete executable example in the body (e.g., a Zod safeParse route handler returning 400 with structured errors) so the most common case is copy-paste ready rather than inline fragments.
Fix the dangling links inside references/REFERENCE.md (authentication.md and security-headers.md do not exist in the bundle) — either create those files or fold their content into REFERENCE.md.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is directive bullets with no explanation of concepts Claude already knows ('Use Zod, Joi, or class-validator at API boundary... Return 400 with structured errors on failure'), so it mostly earns its tokens. Not 5 because the same references/REFERENCE.md link is stated twice and pervasive bold markup plus a cryptic 'Canonical response anchors' section add noise; not 3 since there is no real over-explanation or padding. | 4 / 5 |
Actionability | Concrete, mostly executable guidance: named libraries (Zod, DOMPurify, Argon2id, jsonwebtoken/jose) and concrete patterns like 'pool.query(... WHERE id = $1, [id])' and 'execFileSync(git, [arg1, arg2])'. Not 5 because there are no complete copy-paste-ready code blocks in the body — only inline fragments; not 3 because the fragments are specific and real, not pseudocode. | 4 / 5 |
Workflow Clarity | Organized by concern with an explicit verification checkpoint ('call getDiagnostics (typescript-lsp) to confirm type narrowing correct before finalizing') and a targeted Anti-Patterns section. Not 5 because there is no sequence or fix-and-retry loop — it is topical guidance rather than a workflow, and the Verification step is a single one-way check; not 3 because a genuine checkpoint exists and each section's instructions are unambiguous. | 4 / 5 |
Progressive Disclosure | The body is a lean overview pointing one level deep to a real file, well signaled: 'See references/REFERENCE.md for Zod validation schemas, secure cookie setup, and JWT auth patterns.' Not 5 because the same reference is cited in two places and REFERENCE.md itself links to authentication.md and security-headers.md, which do not exist in the bundle (dangling second-level references); not 3 because the SKILL.md-to-REFERENCE.md split is appropriate and clearly navigable. | 4 / 5 |
Total | 16 / 20 Passed |