django-security

Django 安全最佳实践、认证、授权、CSRF 防护、SQL 注入预防、XSS 预防和安全部署配置。

1.17x

Quality

61%

Does it follow best practices?

Impact

95%

1.17x

Average score across 6 eval scenarios

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./docs/zh-CN/skills/django-security/SKILL.md

Quality

Content

57%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a thorough, highly actionable Django security reference with strong code examples and a useful checklist, but it is monolithic, somewhat redundant, and lacks progressive disclosure via separate reference files.

Suggestions

Split large topic blocks (e.g., API security, file uploads, deployment configuration) into reference files under ./references/ and link to them from SKILL.md to improve progressive disclosure.

Remove duplicated settings and middleware (CSP/security headers appear in multiple sections) to tighten conciseness.

Add a short validation/verification workflow for deployment hardening (e.g., 'run security headers check, verify DEBUG=False, confirm HTTPS redirect') with explicit checkpoints.

Dimension	Reasoning	Score
Conciseness	Mostly efficient code with brief, useful annotations, but the ~590-line body repeats several settings (SECURE_CONTENT_TYPE_NOSNIFF, X_FRAME_OPTIONS, CSP middleware defined twice) and could be tightened by deduplicating.	3 / 5
Actionability	Extensive concrete, mostly copy-paste-ready code covering settings, models, views, permissions, and middleware; minor gaps such as ImproperlyConfigured used without an import keep it just below fully executable.	4 / 5
Workflow Clarity	Content is well-organized by topic with a closing checklist, but as a reference/best-practices guide it lacks a sequenced multi-step workflow with explicit validation checkpoints.	3 / 5
Progressive Disclosure	Good section structure, but all content is inlined in one ~590-line SKILL.md with no bundle files and no one-level-deep references; several topics (API security, file uploads, deployment) could be split into separate reference files.	3 / 5
	Total	13 / 20 Passed

Description

66%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description clearly names the domain and several concrete security subtopics with good natural trigger terms, but it lacks an explicit 'when to use' clause, which limits completeness. It is distinct and largely free of fluff.

Suggestions

Add an explicit 'Use when...' trigger clause, e.g. 'Use when setting up Django authentication, reviewing a Django app for security, or hardening a Django deployment.'

Lead with concrete verbs instead of the generic 'best practices' framing (e.g. 'Configure, audit, and harden Django applications against CSRF, SQL injection, and XSS').

Include a few synonyms/file cues users might say ('Django REST API security', 'Django permissions') to broaden trigger coverage.

Dimension	Reasoning	Score
Specificity	Lists several concrete capability areas (认证、授权、CSRF 防护、SQL 注入预防、XSS 预防、安全部署配置) under the Django security domain, covering the topic comprehensively, though the framing verb 'best practices' is somewhat generic rather than action-specific.	4 / 5
Completeness	Has a clear 'what' (Django security best practices across named areas) but no 'Use when...' clause or equivalent explicit trigger guidance in the description, which caps completeness at 3 per the rubric.	3 / 5
Trigger Term Quality	Good coverage of natural terms a user would actually say ('Django', 'CSRF', 'SQL 注入', 'XSS', '认证', '授权'); a few synonyms or variations are missing but the core triggers are present.	4 / 5
Distinctiveness Conflict Risk	Mostly distinct niche (Django-specific security: CSRF, SQLi, XSS, auth) with minimal overlap risk; minor possible overlap with a generic 'security review' skill due to the broad 'best practices' framing.	4 / 5
	Total	15 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (594 lines); consider splitting into references/ and linking	Warning
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	14 / 16 Passed

Repository: affaan-m/ECC
Path: docs/zh-CN/skills/django-security/SKILL.md
Commit: e04ea0b

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.