CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

ai-code-mode

LLM-generated TypeScript execution in sandboxed environments: createCodeModeTool() with isolate drivers (createNodeIsolateDriver, createQuickJSIsolateDriver, createQuickJSBunIsolateDriver, createCloudflareIsolateDriver), codeModeWithSnippets() for persistent snippet libraries, trust strategies, snippet storage (FileSystem, LocalStorage, InMemory, Mongo), client-side execution progress via code_mode:* custom events in useChat.

Quality

77%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./packages/ai-code-mode/skills/ai-code-mode/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

71%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A strong, highly actionable reference with copy-paste-ready code for every pattern and good sequencing including a native-module probe checkpoint. Its weaknesses are token-efficiency (repeated boilerplate examples) and the absence of any progressive disclosure — everything, including event-table and driver API reference detail, is inlined in a single long file.

Suggestions

Deduplicate the fetchWeather toolDefinition (show it once in Setup and reference it, e.g. 'using fetchWeather from above', in the snippets and lazy-tools sections), and collapse the two parallel setup examples into one full example plus a short delta for createCodeMode.

Move the event field tables, the full client React component, and the per-driver option/trust-strategy reference detail into references/ files (e.g. references/events.md, references/drivers.md, references/snippets.md) with clearly signaled one-level-deep links from the body.

Add an explicit validation step to the core setup workflow (e.g. verify the sandbox executes a trivial snippet and check probe output before deploying) to reach the checkpoint completeness of the top workflow anchor.

DimensionReasoningScore

Conciseness

The body is information-dense and mostly free of conceptual padding, but it is noticeably loose in places: the fetchWeather toolDefinition is repeated in full three times (Setup, snippets, lazy tools sections), and both createCodeModeTool and createCodeMode setups are shown as complete POST handlers with duplicated imports and chat wiring. This fits 'mostly efficient but could be tightened' (anchor 3) rather than the minor-trim profile of anchor 4.

3 / 5

Actionability

Every section provides complete, executable TypeScript/TSX that can be copied directly: full driver configurations with defaults in comments, complete chat endpoint wiring, a full React component for custom-event handling, custom trust-strategy config, lazy-tools config with a table of includeDescription values, and paired Wrong/Right examples for each common mistake. Code covers the common cases comprehensively.

5 / 5

Workflow Clarity

The flow is clearly sequenced (Setup → driver choice with a comparison table → advanced patterns → Common Mistakes → Cross-References), the discover_tools flow is spelled out step-by-step, and the probeIsolatedVm compatibility check provides an explicit validate-before-act checkpoint for the risky native-module case. It falls short of anchor 5 because the core setup patterns lack explicit verify/output-validation steps (e.g. no guidance on testing that the worker or probe succeeded beyond the one probe example).

4 / 5

Progressive Disclosure

No bundle files exist (no references/, scripts/, or assets/ directories) and the entire ~600-line body lives in SKILL.md, including detailed API reference material that would fit better in separate files: the full VM/custom event field tables, the ~80-line client React component, trust-strategy threshold internals, and per-driver option references. Section structure is good, but 'content that should be separate is inline' matches anchor 3; the skill is far beyond the under-50-line simple-skill exception that would allow a 5 without external files.

3 / 5

Total

15

/

20

Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A dense, specific description that comprehensively names the skill's capabilities via concrete API identifiers, making it highly distinctive. Its main weakness is the complete absence of 'when to use' guidance — no 'Use when...' clause or trigger scenarios — which caps completeness and slightly weakens trigger-term quality.

Suggestions

Append a 'Use when...' clause, e.g. 'Use when the LLM should write and run TypeScript in a sandbox to orchestrate tools, when using @tanstack/ai Code Mode, or when the user mentions code mode, isolates, or sandboxed code execution.'

Add a couple of natural trigger synonyms users might type ('sandbox', 'code execution', 'execute_typescript') to broaden trigger-term coverage beyond the current phrasing.

DimensionReasoningScore

Specificity

The description lists multiple concrete, named capabilities: 'createCodeModeTool() with isolate drivers (createNodeIsolateDriver, createQuickJSIsolateDriver, createQuickJSBunIsolateDriver, createCloudflareIsolateDriver)', 'codeModeWithSnippets()', 'trust strategies, snippet storage (FileSystem, LocalStorage, InMemory, Mongo)', and 'client-side execution progress via code_mode:* custom events'. Coverage of the skill's surface area is comprehensive with specific API names rather than generic verbs — clearly above the anchor 4 example, which lists actions but with minor gaps.

5 / 5

Completeness

The 'what' is answered clearly and concretely (sandboxed execution of LLM-generated TypeScript with named APIs), but there is no 'Use when...' clause or equivalent explicit trigger guidance anywhere in the description. Per the rubric guideline, a missing 'Use when' clause caps completeness at 3: clear 'what' with 'when' absent or only weakly implied.

3 / 5

Trigger Term Quality

Natural phrases a user would say include 'LLM-generated TypeScript execution', 'sandboxed environments', 'persistent snippet libraries', and 'execution progress', plus the concrete code_mode:* event namespace. A few natural terms are missing (e.g. 'sandbox', 'code execution', 'isolates' as standalone words users might type), so it does not reach the comprehensive synonym coverage of anchor 5, but it is well above the sparse keyword coverage of anchor 3.

4 / 5

Distinctiveness Conflict Risk

The description occupies a clear niche (sandboxed code execution for the TanStack AI library) anchored by unique API names (createCodeModeTool, codeModeWithSnippets, the four driver constructors) that no adjacent skill would share, giving minimal conflict risk. It is not merely 'mostly distinct' (anchor 4) — the named functions make it hard to confuse with a generic tool-calling or chat skill.

5 / 5

Total

17

/

20

Passed

Validation

87%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

skill_md_line_count

SKILL.md is long (610 lines); consider splitting into references/ and linking

Warning

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

14

/

16

Passed

Repository

TanStack/ai

Path

packages/ai-code-mode/skills/ai-code-mode/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.