file-uploads

Careful about security and performance. Never trusts file extensions. Knows that large uploads need special handling. Prefers presigned URLs over server proxying.

0.51x

Quality

19%

Does it follow best practices?

Impact

50%

0.51x

Average score across 2 eval scenarios

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/file-uploads/SKILL.md

Quality

Content

22%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

This skill is essentially a stub — it identifies important security concerns around file uploads but provides zero actionable implementation guidance. The sharp edges table is a useful starting point but the solutions are placeholder comments rather than concrete code or steps. For a security-critical domain like file uploads, the complete absence of executable examples, validation workflows, and detailed guidance makes this skill ineffective.

Suggestions

Add executable code examples for each sharp edge solution: magic byte checking (e.g., using python-magic or file signatures), filename sanitization, and size limit enforcement.

Provide a concrete workflow for file upload handling with validation checkpoints: receive upload → validate magic bytes → sanitize filename → check size → store → verify.

Add presigned URL generation examples (e.g., AWS S3 boto3 code) since the skill specifically calls out preferring presigned URLs over server proxying.

Replace the vacuous 'When to Use' section with actual trigger conditions or remove it entirely.

Dimension	Reasoning	Score
Conciseness	The sharp edges table is reasonably concise, but the 'When to Use' section is a vacuous filler sentence that adds nothing. The role description partially repeats the YAML description. Some unnecessary padding but not severely verbose.	3 / 5
Actionability	There is no concrete, executable guidance anywhere. The sharp edges table lists issues and solutions as comments (e.g., '# CHECK MAGIC BYTES') but provides no actual code, commands, or specific steps to implement any of them. This is entirely vague direction.	1 / 5
Workflow Clarity	There is no workflow, no sequenced steps, and no validation checkpoints. The skill deals with security-sensitive operations (file uploads, path traversal prevention) but provides zero process guidance or feedback loops.	1 / 5
Progressive Disclosure	The content is short and structured with a table, which is fine for a brief overview. However, there are no references to any supporting files for the detailed implementations that are clearly needed (magic byte checking, presigned URL patterns, sanitization code), and no bundle files exist to support it.	3 / 5
	Total	8 / 20 Passed

Description

16%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

This description reads as a set of design principles or coding guidelines rather than a skill description. It fails to state what the skill does, what domain it operates in, or when it should be selected. The use of first/third person preferences ('Never trusts', 'Prefers') describes attitudes rather than capabilities, making it nearly impossible for Claude to correctly select this skill from a list.

Suggestions

Rewrite to clearly state what the skill does with concrete action verbs, e.g., 'Handles file uploads to cloud storage, validates file types by inspecting content headers, generates presigned URLs for direct uploads to S3.'

Add an explicit 'Use when...' clause with natural trigger terms, e.g., 'Use when the user needs to upload files, handle file storage, work with S3, or implement secure file transfer.'

Move the design principles (security, performance preferences) into the skill body rather than the description, which should focus on capabilities and trigger conditions.

Dimension	Reasoning	Score
Specificity	The description mentions some concepts like 'file extensions', 'large uploads', and 'presigned URLs', but these are design principles/preferences rather than concrete actions. It never states what the skill actually does — no verbs describing capabilities like 'uploads files', 'validates content types', etc.	2 / 5
Completeness	The description fails to answer both 'what does this do' and 'when should Claude use it'. It reads as a list of design principles rather than a skill description. There is no 'Use when...' clause and no clear statement of the skill's purpose or function.	1 / 5
Trigger Term Quality	Terms like 'presigned URLs', 'file extensions', and 'large uploads' are somewhat relevant but are technical jargon rather than natural user phrases. A user would more likely say 'upload a file', 'file upload', or 'S3 upload' rather than these implementation-detail terms.	2 / 5
Distinctiveness Conflict Risk	The description is too vague about its domain to be distinctive. 'Security and performance' and 'file extensions' could apply to many different skills. While 'presigned URLs' hints at cloud storage/upload functionality, the lack of a clear domain statement creates high overlap risk.	2 / 5
	Total	7 / 20 Passed

Validation

90%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 10 / 11 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	10 / 11 Passed

Repository: administrakt0r/AI-Agents-Safe-Coding-Skills
Path: skills/file-uploads/SKILL.md
Commit: 57c135b

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.