securability-engineering
Meta-skill that wraps code generation to enforce OWASP FIASSE securable coding attributes and principles. Use when generating, scaffolding, or refactoring code so that the output is engineered to be inherently securable by default. Applies the nine SSEM attributes (Analyzability, Modifiability, Testability, Confidentiality, Accountability, Authenticity, Availability, Integrity, Resilience), the Transparency principle, and OWASP FIASSE defensive coding practices to every code generation task. Invoke this skill alongside or instead of raw code generation when the user asks for secure code, securable code, FIASSE-compliant code, or when generating security-sensitive components (auth, input handling, data access, API endpoints, trust boundaries).
68
81%
Does it follow best practices?
Impact
—
No eval scenarios have been run
Passed
No known issues
Quality
Discovery
100%Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.
This is an excellent skill description that clearly articulates what the skill does (enforces OWASP FIASSE securable coding attributes during code generation), when to use it (explicit trigger scenarios including user requests for secure/FIASSE-compliant code and security-sensitive components), and how it's distinct from other skills. It uses proper third-person voice throughout and provides rich, specific trigger terms. The only minor concern is the density of acronyms which could be slightly overwhelming, but they serve the purpose of specificity and distinctiveness well.
| Dimension | Reasoning | Score |
|---|---|---|
Specificity | Lists multiple specific concrete actions: 'code generation', 'scaffolding', 'refactoring', and enumerates the nine SSEM attributes by name (Analyzability, Modifiability, Testability, etc.) plus specific defensive coding practices. Also names concrete security-sensitive components (auth, input handling, data access, API endpoints, trust boundaries). | 3 / 3 |
Completeness | Clearly answers both 'what' (wraps code generation to enforce OWASP FIASSE securable coding attributes and principles, applies nine SSEM attributes and defensive coding practices) and 'when' (explicit 'Use when' and 'Invoke this skill' clauses with specific trigger scenarios like generating secure code, FIASSE-compliant code, or security-sensitive components). | 3 / 3 |
Trigger Term Quality | Includes strong natural trigger terms users would say: 'secure code', 'securable code', 'FIASSE-compliant code', 'auth', 'input handling', 'data access', 'API endpoints', 'trust boundaries', 'OWASP', 'refactoring code'. Good coverage of both domain-specific and natural language terms. | 3 / 3 |
Distinctiveness Conflict Risk | Highly distinctive niche focused specifically on OWASP FIASSE security compliance for code generation. The specific framework references (SSEM, FIASSE, OWASP) and the 'meta-skill' framing clearly distinguish it from generic code generation or general security skills. | 3 / 3 |
Total | 12 / 12 Passed |
Implementation
62%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
This is a well-structured meta-skill with a clear workflow, comprehensive checklist, and good use of tables for attribute enforcement rules. Its main weaknesses are the lack of concrete code examples showing what compliant output looks like (critical for a code generation wrapper) and some verbosity in the foundational principles section that describes philosophy Claude can infer. The progressive disclosure via data/fiasse/ references is well-designed but unverifiable without bundle files.
Suggestions
Add at least one concrete before/after code example showing a simple function (e.g., an API endpoint) generated with and without FIASSE constraints applied, to make the skill truly actionable for code generation.
Trim the Foundational Constraints section — condense the five principles into a compact table or bullet list rather than paragraph explanations, since Claude can reference the data/fiasse/ files for full definitions.
Consider moving the detailed SSEM Attribute Enforcement tables into a referenced file (e.g., data/fiasse/ssem-enforcement-rules.md) and keeping only a summary in the main SKILL.md to improve token efficiency.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The skill is fairly well-structured but includes some verbose explanatory content that Claude already knows (e.g., explaining what trust boundaries are, restating general secure coding principles). The foundational constraints section (S2.1–S2.4) largely describes philosophy rather than actionable constraints, adding token cost without proportional value. However, the tables and checklist are efficient formats. | 2 / 3 |
Actionability | The skill provides concrete rules (e.g., '≤ 30 LoC', 'cyclomatic complexity < 10', 'canonicalize → sanitize → validate') and a useful checklist, but lacks any executable code examples demonstrating what FIASSE-compliant generated code actually looks like. For a code generation wrapper skill, at least one before/after code example would significantly improve actionability. | 2 / 3 |
Workflow Clarity | The six-step workflow (Identify Context → Apply SSEM → Handle Trust Boundaries → Instrument Transparency → Generate Code → Self-Check) is clearly sequenced with a comprehensive validation checklist at the end. The self-check step serves as an explicit verification checkpoint before returning output, which is appropriate for this type of meta-skill. | 3 / 3 |
Progressive Disclosure | The skill references `data/fiasse/` files extensively (S2.1.md, S3.2.1.md, etc.) and a companion review skill, which is good progressive disclosure structure. However, no bundle files were provided, so we cannot verify these references resolve. The SKILL.md itself is quite long (~150 lines of substantive content) and some of the attribute enforcement tables could potentially be split into referenced files to keep the main skill leaner. | 2 / 3 |
Total | 9 / 12 Passed |
Validation
100%Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.
Validation — 11 / 11 Passed
Validation for skill structure
No warnings or errors.
- Repository
- OWASP/secure-agent-playbook
- Commit
3f4fcb6
- Reviewed
Table of Contents
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.