CtrlK
BlogDocsLog inGet started
Tessl Logo

fullstack-guardian

Builds security-focused full-stack web applications by implementing integrated frontend and backend components with layered security at every level. Covers the complete stack from database to UI, enforcing auth, input validation, output encoding, and parameterized queries across all layers. Use when implementing features across frontend and backend, building REST APIs with corresponding UI, connecting frontend components to backend endpoints, creating end-to-end data flows from database to UI, or implementing CRUD operations with UI forms. Distinct from frontend-only, backend-only, or API-only skills in that it simultaneously addresses all three perspectives—Frontend, Backend, and Security—within a single implementation workflow. Invoke for full-stack feature work, web app development, authenticated API routes with views, microservices, real-time features, monorepo architecture, or technology selection decisions.

71

Quality

87%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Failed to scan

The risk profile of this skill

SKILL.md
Quality
Evals
Security

Quality

Content

78%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured skill body that balances a lean overview with progressive disclosure via a clearly navigated reference table and a concrete three-perspective example. The main gap is the absence of an explicit error-recovery feedback loop in the workflow.

Suggestions

Add an explicit validate→fix→retry step after the security checkpoint (e.g., 'If the checklist fails, fix and re-run before proceeding to implementation') to strengthen the feedback loop.

Tighten the inline '[Security]' commentary under the example to bullet essentials, removing phrasing that restates what the code already shows.

DimensionReasoningScore

Conciseness

The body is largely lean — workflow steps, a reference table, terse MUST/MUST NOT constraints, and one example — with only minor over-explanation in the inline security commentary that could be trimmed.

4 / 5

Actionability

Provides a complete, executable three-perspective code example (Python route + TypeScript fetch) and concrete directives, though the bulk of detailed actionable guidance is delegated to reference files rather than inline.

4 / 5

Workflow Clarity

The six-step Core Workflow is clearly sequenced with an explicit security checkpoint ('Run through references/security-checklist.md before writing any code') and incremental testing, but lacks an explicit validate→fix→retry feedback loop.

4 / 5

Progressive Disclosure

SKILL.md is a concise overview with a well-signaled, one-level-deep reference table whose 'Load When' column maps each of the 10 topics to a real file in references/, all of which exist on disk.

5 / 5

Total

17

/

20

Passed

Description

96%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that concretely states capabilities, trigger terms, and use-conditions while explicitly distinguishing itself from sibling skills. Its only weakness is a somewhat broad trailing trigger list that risks overlap with architecture and devops skills.

Suggestions

Trim the 'Invoke for...' tail to full-stack-specific triggers; drop 'monorepo architecture' and 'technology selection decisions' to reduce overlap with architecture-designer/devops-engineer.

Collapse the redundant 'Use when...' and 'Invoke for...' lists into a single trigger clause to cut verbosity without losing coverage.

DimensionReasoningScore

Specificity

Lists multiple concrete actions — 'enforcing auth, input validation, output encoding, and parameterized queries', 'building REST APIs with corresponding UI', 'creating end-to-end data flows from database to UI', 'implementing CRUD operations with UI forms' — giving comprehensive coverage of the skill's capabilities.

5 / 5

Completeness

Explicitly answers both 'what' ('Builds security-focused full-stack web applications...') and 'when' ('Use when implementing features across frontend and backend...') with concrete trigger phrases and an explicit 'Invoke for...' list.

5 / 5

Trigger Term Quality

Includes natural phrases users actually say — 'implement features', 'build REST APIs', 'CRUD operations', 'microservices', 'real-time features', 'monorepo', 'technology selection' — with broad synonym coverage.

5 / 5

Distinctiveness Conflict Risk

The 'Distinct from frontend-only, backend-only, or API-only skills' clause carves a clear niche, but the broad 'Invoke for... microservices, monorepo architecture, or technology selection decisions' tail overlaps with related architecture/devops skills, introducing minor conflict risk.

4 / 5

Total

19

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
Jeffallan/claude-skills
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.