Name: file-uploads
Rating: 49.19 (1 reviews)
Author: administrakt0r

file-uploads

Careful about security and performance. Never trusts file extensions. Knows that large uploads need special handling. Prefers presigned URLs over server proxying.

0.51x

Quality

42%

Does it follow best practices?

Impact

50%

0.51x

Average score across 2 eval scenarios

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./plugins/AI-Agents-Safe-Coding-Skills/skills/file-uploads/SKILL.md

The canonical home for this skill is file-uploads in administrakt0r/AI-Agents-Safe-Coding-Skills

Quality

Content

40%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is brief but low-value: it repeats the description verbatim, lists hazards as vague hashtag directives instead of executable guidance, has no sequenced workflow or validation checkpoints, and closes with a generic filler 'When to Use' section. It is organized into sections but offers little actionable instruction.

Suggestions

Replace hashtag solution labels with concrete, executable guidance (e.g., library calls to sniff magic bytes, exact size-limit config, filename sanitization code, presigned-URL generation commands).

Provide a sequenced upload-handling workflow with explicit validation checkpoints (validate type -> enforce size -> sanitize filename -> generate presigned URL).

Rewrite the generic 'When to Use' section with concrete trigger conditions, and avoid restating the frontmatter description in the body.

Dimension	Reasoning	Score
Conciseness	The body is short but repeats the description's stance sentence verbatim and includes a filler 'When to Use' line that adds nothing, matching the 'mostly efficient but could be tightened' anchor 3 rather than the lean anchor 4.	3 / 5
Actionability	Solutions are vague hashtag-style directives ('# CHECK MAGIC BYTES', '# SANITIZE FILENAMES') with no code, commands, library names, or concrete steps, fitting anchor 2 ('minimal concrete guidance') rather than the pseudocode-level anchor 3.	2 / 5
Workflow Clarity	There is no sequenced workflow and no validation steps despite uploads being a risky/batch context; the hazard table gives minimal shape but no sequence, placing it between the incoherent anchor 1 and the rough-sequence anchor 2.	2 / 5
Progressive Disclosure	Under 50 lines with no external references needed, it uses organized sections and a hazard table, fitting the well-organized anchor 4; the generic filler 'When to Use' section keeps it below 5.	4 / 5
	Total	11 / 20 Passed

Description

45%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description conveys security and performance principles around file uploads but reads as a set of stances rather than concrete capabilities, lacks any 'Use when...' trigger clause, and omits common natural trigger terms. It is distinguishable as a niche but under-specified on when to invoke.

Suggestions

Add a concrete 'Use when ...' trigger clause naming natural user phrases (e.g., 'Use when implementing file uploads, multipart uploads, or S3 presigned URLs').

Replace stance phrasing with specific capabilities the skill performs (e.g., 'Validates file magic bytes, enforces size limits, sanitizes filenames, generates presigned upload URLs').

Include natural trigger terms and synonyms such as 'file upload', 'uploading files', 'S3', and 'multipart upload'.

Dimension	Reasoning	Score
Specificity	Names the domain plus a few concrete stances ('Never trusts file extensions', 'Prefers presigned URLs over server proxying'), but these are principles rather than a list of specific actions, so it sits at anchor 3 and not the multi-action coverage of 4.	3 / 5
Completeness	It describes a vague 'what' (security/performance stance on uploads) but has no 'Use when...' clause or equivalent trigger guidance, so per the missing-trigger cap it lands at anchor 2 ('vague what, no when') rather than 3.	2 / 5
Trigger Term Quality	Contains relevant technical keywords ('file extensions', 'large uploads', 'presigned URLs') but misses the natural phrases a user would say ('file upload', 'uploading files', 'S3', 'multipart'), matching anchor 3 rather than the fuller coverage of 4.	3 / 5
Distinctiveness Conflict Risk	The presigned-URL / file-upload niche is mostly distinct with only minor overlap risk against related storage skills, matching anchor 4; it is not crisp enough on triggers for a 5.	4 / 5
	Total	12 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: administrakt0r/AI-Agents-Safe-Coding-Skills
Path: plugins/AI-Agents-Safe-Coding-Skills/skills/file-uploads/SKILL.md
Commit: 57c135b

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.