CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

nodejs-best-practices

Node.js development principles and decision-making. Framework selection, async patterns, security, and architecture. Teaches thinking, not copying.

Quality

59%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./plugins/AI-Agents-Safe-Coding-Skills/skills/nodejs-best-practices/SKILL.md

The canonical home for this skill is nodejs-best-practices in administrakt0r/AI-Agents-Safe-Coding-Skills

SKILL.md
Quality
Evals
Security

Quality

Content

42%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-organized, consistently formatted decision guide that favors principles over code, but much of it restates knowledge Claude already has (status codes, async combinators, event-loop basics) with no executable examples and no progressive disclosure — everything is inlined in one ~330-line file. The decision trees and checklists are genuinely useful, but version-sensitive details are scattered rather than isolated.

Suggestions

Move the detailed framework/runtime comparison tables and the security checklist into reference files (e.g., references/frameworks.md, references/security.md), keeping SKILL.md as a lean overview with clearly signaled links.

Trim sections that restate knowledge Claude already has — the HTTP status-code table, Promise.all/allSettled guidance, and event-loop basics — keeping only the decision-relevant parts.

Add a few short executable snippets for the core taught patterns (custom error class, centralized error middleware, Zod boundary validation) and isolate version-sensitive details (Node 22 type-stripping, 2025 framework landscape) in a clearly marked section.

DimensionReasoningScore

Conciseness

Multiple full sections restate concepts Claude already knows: the HTTP status-code table (400/401/403/404/409/422/500), async/await vs Promise.all/allSettled/race, event-loop I/O-bound vs CPU-bound, ESM vs CommonJS basics, and a generic security checklist. Version- and date-sensitive details ('2025', 'Node.js 22+', '--experimental-strip-types') are woven through the body rather than isolated in a deprecated/old-patterns section. It is above anchor 1 because the style is terse tables rather than padded prose, but 'several unnecessary explanations' clearly applies.

2 / 5

Actionability

There is concrete, specific guidance — named frameworks and libraries (Hono, Fastify, Zod, Valibot, ArkType), a runnable command ('node --test src/**/*.test.ts'), and a concrete flag ('--experimental-strip-types') — but the skill deliberately provides no executable examples of the patterns it teaches (custom error classes, centralized error middleware, validation code, worker-thread offloading). Not 4 because the gaps are major (zero executable code for core patterns); not 2 because decisions are backed by substantial specific, actionable detail.

3 / 5

Workflow Clarity

A rough process is present ('How to Use This Skill': ask the user, choose based on context, don't default; plus the section 11 'Decision Checklist' before implementing), but there are no validation checkpoints or feedback loops verifying that a chosen approach works (e.g., no 'profile/verify before committing' step despite 'Profile before optimizing'). Not 4 because the checkpoints are unchecked question boxes without verification; not 2 because the sequence and checklists that exist are coherent.

3 / 5

Progressive Disclosure

Sections are well-organized with clear headers, but the entire ~330-line body lives inline in SKILL.md with no references to separate files — the detailed framework/runtime comparison tables and the security checklist are candidates for reference files to keep SKILL.md an overview. Not 4 because there are no references at all and the body far exceeds overview size (the under-50-lines exception does not apply); not 2 because the structure is good, not minimal.

3 / 5

Total

11

/

20

Passed

Description

57%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description names the Node.js domain and several relevant capability areas using natural trigger keywords, but it lacks any explicit 'Use when...' trigger clause, which caps completeness at 3. Its broad scope ('security, and architecture') also creates overlap risk with adjacent backend/security skills.

Suggestions

Add an explicit trigger clause, e.g., 'Use when choosing a Node.js framework, designing async or error-handling patterns, or reviewing Node.js code for security and architecture issues.'

Include more natural trigger variations users would say, such as 'Express', 'Fastify', 'NestJS', 'npm', 'backend', or 'server-side JavaScript'.

Replace the meta tagline 'Teaches thinking, not copying' with a concrete capability statement (e.g., 'Guides framework selection, async pattern choice, and security decisions').

DimensionReasoningScore

Specificity

Names the domain ('Node.js development principles and decision-making') and lists several areas ('Framework selection, async patterns, security, and architecture'), but these are topic labels rather than concrete actions, and coverage has more than minor gaps (testing, error handling, deployment are unmentioned). It is above anchor 2 because more than minimal/generic capabilities are named, but below anchor 4 because the gaps exceed 'minor' and the items are nouns, not actions.

3 / 5

Completeness

It has a reasonably clear 'what' ('development principles and decision-making' across four named areas) but no 'Use when...' clause or equivalent explicit trigger guidance, which caps completeness at 3 per the judging guidelines. Not 4 because the 'when' is entirely absent, not merely implicit or underspecified.

3 / 5

Trigger Term Quality

'Node.js', 'framework', 'async patterns', 'security', and 'architecture' are terms users would naturally say when needing this skill — good keyword coverage. It is not 5 because common variations and synonyms are missing (e.g., 'Express', 'npm', 'backend', 'JavaScript server'), and not 3 because coverage goes beyond just 'some relevant keywords'.

4 / 5

Distinctiveness Conflict Risk

The 'Node.js' runtime naming gives it a clear domain, but the broad scope ('security, and architecture') creates overlap risk with general JavaScript, backend-architecture, or security skills. It is more specific than anchor 2's 'very broad' but the overlap risk is more than 'minor', so anchor 4 is not earned.

3 / 5

Total

13

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository

administrakt0r/AI-Agents-Safe-Coding-Skills

Path

plugins/AI-Agents-Safe-Coding-Skills/skills/nodejs-best-practices/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.