CtrlK
BlogDocsLog inGet started
Tessl Logo

file-uploads

Careful about security and performance. Never trusts file extensions. Knows that large uploads need special handling. Prefers presigned URLs over server proxying.

49

0.51x
Quality

42%

Does it follow best practices?

Impact

50%

0.51x

Average score across 2 eval scenarios

SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./plugins/AI-Agents-Safe-Coding-Skills-claude/skills/file-uploads/SKILL.md

The canonical home for this skill is file-uploads in administrakt0r/AI-Agents-Safe-Coding-Skills

SKILL.md
Quality
Evals
Security

Quality

Content

40%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is brief but low-value: it repeats the description verbatim, lists hazards as vague hashtag directives instead of executable guidance, has no sequenced workflow or validation checkpoints, and closes with a generic filler 'When to Use' section. It is organized into sections but offers little actionable instruction.

Suggestions

Replace hashtag solution labels with concrete, executable guidance (e.g., library calls to sniff magic bytes, exact size-limit config, filename sanitization code, presigned-URL generation commands).

Provide a sequenced upload-handling workflow with explicit validation checkpoints (validate type -> enforce size -> sanitize filename -> generate presigned URL).

Rewrite the generic 'When to Use' section with concrete trigger conditions, and avoid restating the frontmatter description in the body.

DimensionReasoningScore

Conciseness

The body is short but repeats the description's stance sentence verbatim and includes a filler 'When to Use' line that adds nothing, matching the 'mostly efficient but could be tightened' anchor 3 rather than the lean anchor 4.

3 / 5

Actionability

Solutions are vague hashtag-style directives ('# CHECK MAGIC BYTES', '# SANITIZE FILENAMES') with no code, commands, library names, or concrete steps, fitting anchor 2 ('minimal concrete guidance') rather than the pseudocode-level anchor 3.

2 / 5

Workflow Clarity

There is no sequenced workflow and no validation steps despite uploads being a risky/batch context; the hazard table gives minimal shape but no sequence, placing it between the incoherent anchor 1 and the rough-sequence anchor 2.

2 / 5

Progressive Disclosure

Under 50 lines with no external references needed, it uses organized sections and a hazard table, fitting the well-organized anchor 4; the generic filler 'When to Use' section keeps it below 5.

4 / 5

Total

11

/

20

Passed

Description

45%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description conveys security and performance principles around file uploads but reads as a set of stances rather than concrete capabilities, lacks any 'Use when...' trigger clause, and omits common natural trigger terms. It is distinguishable as a niche but under-specified on when to invoke.

Suggestions

Add a concrete 'Use when ...' trigger clause naming natural user phrases (e.g., 'Use when implementing file uploads, multipart uploads, or S3 presigned URLs').

Replace stance phrasing with specific capabilities the skill performs (e.g., 'Validates file magic bytes, enforces size limits, sanitizes filenames, generates presigned upload URLs').

Include natural trigger terms and synonyms such as 'file upload', 'uploading files', 'S3', and 'multipart upload'.

DimensionReasoningScore

Specificity

Names the domain plus a few concrete stances ('Never trusts file extensions', 'Prefers presigned URLs over server proxying'), but these are principles rather than a list of specific actions, so it sits at anchor 3 and not the multi-action coverage of 4.

3 / 5

Completeness

It describes a vague 'what' (security/performance stance on uploads) but has no 'Use when...' clause or equivalent trigger guidance, so per the missing-trigger cap it lands at anchor 2 ('vague what, no when') rather than 3.

2 / 5

Trigger Term Quality

Contains relevant technical keywords ('file extensions', 'large uploads', 'presigned URLs') but misses the natural phrases a user would say ('file upload', 'uploading files', 'S3', 'multipart'), matching anchor 3 rather than the fuller coverage of 4.

3 / 5

Distinctiveness Conflict Risk

The presigned-URL / file-upload niche is mostly distinct with only minor overlap risk against related storage skills, matching anchor 4; it is not crisp enough on triggers for a 5.

4 / 5

Total

12

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository
administrakt0r/AI-Agents-Safe-Coding-Skills
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.