CtrlK
BlogDocsLog inGet started
Tessl Logo

securability-engineering

Generate, scaffold, or refactor code so it embodies FIASSE v1.0.4 SSEM qualities by default — 10 attributes, Transparency and Least-Astonishment principles, ASVS-aligned controls, defensive boundary handling. Trigger on "secure/securable/FIASSE-compliant code", "harden", "secure-by-default", "audit-ready", or security-sensitive components (auth, file upload, password reset, input validation, API endpoints, queries) — even when those words are not explicit. For requirements use prd-securability-enhancement; for review use securability-engineering-review. The full PRD→generate→review→enhance loop is opt-in via "--full-loop" or "end-to-end securable".

67

Quality

81%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

67%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A thorough, actionable skill body with strong concrete examples, an explicit step sequence, and a self-check checklist. Its main weakness is conciseness — boundary/input-handling guidance is repeated across several sections — and the absence of explicit error-recovery feedback loops in the workflow.

Suggestions

Consolidate the boundary/input-handling guidance (Foundational Constraints #7/#9, Trust Boundary Handling, Integrity attribute, Anti-Pattern rows, and the checklist) so each rule appears once and cross-references rather than restating.

Add an explicit validation/feedback loop to the Default Mode steps — e.g., after Self-Check, a 'if a checklist item fails, fix and re-verify before returning' instruction.

Move the full SSEM attribute enforcement tables and/or the Anti-Pattern Tag Reference into reference files under data/ (linked from the overview) to reduce inline length and improve progressive disclosure.

DimensionReasoningScore

Conciseness

Dense and mostly efficient, but the same boundary/input-handling guidance is restated across the Foundational Constraints, SSEM attribute tables, Trust Boundary Handling section, Anti-Pattern table, and Generation Checklist, adding notable repetition that could be tightened.

3 / 5

Actionability

Concrete thresholds (≤30 LoC, complexity <10), a copy-paste-ready FastAPI worked example, and an anti-pattern table pairing each bad shape with a correct shape; minor gaps in that most sections prescribe rules rather than fully executable code across common cases.

4 / 5

Workflow Clarity

Clear 8-step Default Mode sequence capped by an explicit Self-Check against the Generation Checklist, but error-recovery feedback loops (validate→fix→retry) are not spelled out.

4 / 5

Progressive Disclosure

Well-signaled one-level-deep references to data/fiasse/, data/asvs/, and plays/securable-generation.md with a dedicated FIASSE References section; some inline reference-grade content (full attribute tables, anti-pattern table) could be split out to keep the overview leaner.

4 / 5

Total

15

/

20

Passed

Description

95%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that clearly states what the skill does and when to trigger it, with rich natural trigger terms and explicit sibling-skill disambiguation. The only minor gap is action specificity staying at the generate/scaffold/refactor level rather than a broader concrete action list.

DimensionReasoningScore

Specificity

Lists several concrete actions ('Generate, scaffold, or refactor code') plus the FIASSE/ASVS quality targets, but the verbs stay somewhat high-level rather than enumerating a comprehensive action set.

4 / 5

Completeness

Explicitly answers both what (generate/scaffold/refactor code embodying SSEM qualities) and when (Trigger on...), with concrete trigger phrases and opt-in loop activation.

5 / 5

Trigger Term Quality

Comprehensive natural trigger coverage — 'secure/securable/FIASSE-compliant code', 'harden', 'secure-by-default', 'audit-ready', plus concrete component words (auth, file upload, password reset) and the 'even when those words are not explicit' adjacency guidance.

5 / 5

Distinctiveness Conflict Risk

Clear FIASSE-securability niche with active disambiguation ('For requirements use prd-securability-enhancement; for review use securability-engineering-review'), minimizing overlap with sibling skills.

5 / 5

Total

19

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

relative_links

Relative link issues: 2 suspicious

Warning

Total

15

/

16

Passed

Repository
OWASP/secure-agent-playbook
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.