security-best-practices

Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks.

Quality

78%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./security-best-practices/SKILL.md

Quality

Content

57%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The skill body is well-structured for progressive disclosure, with a clear overview routing to a real, conventionally-named reference set, but it is let down by verbosity, some vague guidance, and implicit rather than explicit validation checkpoints in the fix workflow.

Suggestions

Tighten verbose prose — e.g. trim the rationale 'insecure code lives on for so long' and condense the TLS aside into a short bullet of rules.

Replace vague fallbacks ('think a little bit about what you know', 'try to search online') with a concrete fallback procedure or explicit allowance for the passive-detection-only mode.

Add an explicit validation checkpoint to the fix workflow (e.g. 'run the project's tests before and after each fix; only commit if they pass') instead of merely referencing testing flows in passing.

Dimension	Reasoning	Score
Conciseness	The body is mostly efficient but padded with unnecessary explanation such as 'It is often the case that insecure code is relied on for other reasons (and this is why insecure code lives on for so long)' and a verbose, conversational TLS aside that could be tightened.	2 / 3
Actionability	Concrete specifics exist (filename pattern '<language>-<framework>-<stack>-security.md', report file 'security_best_practices_report.md', severity sections, line numbers), but they are mixed with vague direction like 'think a little bit about what you know' and 'try to search online'.	2 / 3
Workflow Clarity	The workflow and decision tree sequence the steps, but validation for the code-modifying/fix operations is only implicit ('Always follow any normal testing flows the user has configured') rather than an explicit validate-then-proceed checkpoint, capping the score.	2 / 3
Progressive Disclosure	The SKILL.md is a lean overview pointing to a real, well-organized references directory of 10 files following a documented '<language>-<framework>-<stack>-security.md' naming convention, one level deep with clear navigation.	3 / 3
	Total	9 / 12 Passed

Description

100%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is concise yet fully specifies what the skill does and exactly when to trigger it, with explicit positive and negative triggers and a language guard. It is a strong, low-conflict trigger description.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'Perform language and framework specific security best-practice reviews', 'suggest improvements', and 'secure-by-default coding help' — matching the 'lists multiple specific concrete actions' anchor.	3 / 3
Completeness	Explicitly answers 'what' (reviews + suggest improvements) and 'when' via the explicit 'Trigger only when the user explicitly requests...' clauses, satisfying the full what-and-when anchor.	3 / 3
Trigger Term Quality	Covers natural terms users would say — 'security best practices guidance', 'security review/report', and 'secure-by-default coding help' — with good coverage including common variations.	3 / 3
Distinctiveness Conflict Risk	A clear niche is bounded by 'supported languages (python, javascript/typescript, go)' and an explicit negative 'Do not trigger for general code review, debugging, or non-security tasks', making wrong-skill conflicts unlikely.	3 / 3
	Total	12 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: JetBrains/skills
Path: security-best-practices/SKILL.md
Commit: e0f258b

Reviewed: ~1 month ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.