CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

fullstack-guardian

Builds security-focused full-stack web applications by implementing integrated frontend and backend components with layered security at every level. Covers the complete stack from database to UI, enforcing auth, input validation, output encoding, and parameterized queries across all layers. Use when implementing features across frontend and backend, building REST APIs with corresponding UI, connecting frontend components to backend endpoints, creating end-to-end data flows from database to UI, or implementing CRUD operations with UI forms. Distinct from frontend-only, backend-only, or API-only skills in that it simultaneously addresses all three perspectives—Frontend, Backend, and Security—within a single implementation workflow. Invoke for full-stack feature work, web app development, authenticated API routes with views, microservices, real-time features, monorepo architecture, or technology selection decisions.

68

Quality

86%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

78%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured skill body: an efficient overview page with a sequenced workflow, an explicit security validation checkpoint, crisp MUST/MUST-NOT constraints, and exemplary progressive disclosure through a condition-loaded reference table pointing to ten real files. The residual gaps are minor — illustrative rather than fully runnable example code, no explicit error-recovery loop in the workflow, and a few trimmable footer/example lines.

Suggestions

Add a brief feedback loop to the Core Workflow for the security checkpoint (e.g., "If a checklist item is unresolved, update the design in specs/{feature}_design.md before implementing"), which would lift workflow_clarity to the validation-loop anchor.

Make the three-perspective example fully self-contained or trim its commentary — the backend snippet depends on undefined db/ProfileResponse and the frontend on apiFetch, so either define them in one line or label the snippet as an illustrative pattern.

DimensionReasoningScore

Conciseness

The body is tight: one-line workflow steps ("Validate input on both client and server"), terse MUST DO / MUST NOT DO lists, and a compact reference table — no explanations of concepts Claude already knows. Minor trimming opportunities keep it below anchor 5: the footer attribution/links and parts of the three-perspective example (e.g., explanatory security bullet commentary) are not strictly needed. It is clearly above anchor 3, which requires "some unnecessary explanation".

4 / 5

Actionability

Concrete guidance dominates: executable-looking FastAPI/TypeScript snippets ("@router.get(\"/users/{user_id}/profile\", dependencies=[Depends(require_auth)])", "if (!Number.isInteger(userId) || userId <= 0) throw"), a named design artifact path ("specs/{feature}_design.md"), and a step tied to a real file (references/security-checklist.md). It is not anchor 5 because the example code is illustrative rather than copy-paste runnable (undefined `db`, `apiFetch`, `ProfileResponse` context) and only one common case is exemplified — matching anchor 4's "concrete code with minor gaps".

4 / 5

Workflow Clarity

A clear six-step sequence (Gather requirements → Design → Write technical design → Security checkpoint → Implement → Hand off) with an explicit validation checkpoint ("Run through references/security-checklist.md before writing any code; confirm auth, authz, validation, and output encoding are addressed") and per-component testing ("Test each component as you build"). Anchor 5 would require explicit feedback loops for error recovery (e.g., what to do when the checklist fails) and richer checklists; anchor 3 would require missing or only implicit checkpoints, which is not the case.

4 / 5

Progressive Disclosure

The body is a genuine overview that splits detail correctly: a "Load When" reference table signals ten one-level-deep files (all of which exist in references/ with no nested cross-references between them), and only a minimal representative example is inlined. This matches anchor 5's clear overview with well-signaled one-level-deep references and easy navigation; anchor 4 would require organization gaps that are not present.

5 / 5

Total

17

/

20

Passed

Description

88%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description in third-person voice that clearly states what the skill does (security-focused full-stack implementation with named security controls) and when to use it (two explicit trigger lists). The main weakness is a few missing natural trigger variations and minor overlap risk with architecture-oriented skills.

DimensionReasoningScore

Specificity

Multiple concrete actions are enumerated — "enforcing auth, input validation, output encoding, and parameterized queries", "building REST APIs with corresponding UI", "creating end-to-end data flows from database to UI", "implementing CRUD operations with UI forms" — with comprehensive coverage across the stack. This matches the anchor for multiple specific concrete actions; it does not fit level 4's "minor gaps" since both the security layer and full-stack scope are fully itemized, and level 3 covers only 1-2 actions.

5 / 5

Completeness

Explicitly answers both questions: the "what" ("Builds security-focused full-stack web applications... enforcing auth, input validation, output encoding, and parameterized queries") and the "when" ("Use when implementing features across frontend and backend, building REST APIs with corresponding UI... or implementing CRUD operations with UI forms" plus a second "Invoke for..." list of concrete triggers). This matches the anchor 5 example's dual what+when structure; anchor 4 would require the "when" to be less explicit, which it is not.

5 / 5

Trigger Term Quality

Good natural-term coverage: "full-stack", "REST APIs", "CRUD operations with UI forms", "microservices", "real-time features", "monorepo", "web app development" — phrases a user would plausibly say. It falls short of anchor 5 because some common user variations (e.g., unhyphenated "full stack", phrasings like "hook up the frontend to the backend") are not present, but it is clearly above anchor 3's "missing common variations or synonyms".

4 / 5

Distinctiveness Conflict Risk

The description explicitly carves a niche: "Distinct from frontend-only, backend-only, or API-only skills in that it simultaneously addresses all three perspectives—Frontend, Backend, and Security". However, broad trigger phrases like "technology selection decisions" and "architecture decision" create minor overlap risk with architecture/design skills, so it fits anchor 4 (mostly distinct, minor overlap) rather than anchor 5 (minimal conflict risk).

4 / 5

Total

18

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

Jeffallan/claude-skills

Path

skills/fullstack-guardian/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.