django-security

Django security best practices, authentication, authorization, CSRF protection, SQL injection prevention, XSS prevention, and secure deployment configurations.

Quality

61%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./docs/ja-JP/skills/django-security/SKILL.md

Quality

Content

57%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The skill body is a thorough, code-rich Django security reference with strong actionability, but it is a long monolithic file with redundancy, no external references, and no sequenced workflow with validation checkpoints. Tightening redundancy and splitting bulky references would improve it.

Suggestions

De-duplicate the security-header settings that recur across the production, XSS, and CSP sections, and trim the verbose JS CSRF cookie snippet to the essential fetch header pattern.

Add a sequenced hardening workflow with explicit validation checkpoints (e.g., 'run check --deploy', verify headers with curl) including a validate-fix-retry loop for deployment configuration.

Move bulky reference material (full settings, CSP configuration, file-upload validators) into one-level-deep reference files linked from SKILL.md to improve progressive disclosure.

Dimension	Reasoning	Score
Conciseness	The body is mostly code with brief comments and little concept padding, but it is lengthy (~590 lines) with redundancy — security headers appear in the production settings, XSS, and CSP sections — and the long JS cookie snippet could be trimmed.	3 / 5
Actionability	Abundant concrete, mostly copy-paste-ready code covers common cases (settings, models, views, permissions, middleware), with minor gaps such as `ImproperlyConfigured` and `Response` used without imports and a .env block mixing Python and env format.	4 / 5
Workflow Clarity	Content is organized as a topical reference rather than a sequenced workflow, and there are no validation/feedback-loop checkpoints; the closing checklist provides some verification guidance but no validate-fix-retry cycle.	3 / 5
Progressive Disclosure	Sections are clearly headed and well-organized, but the file is well over 50 lines with all detailed content inlined and no references to separate files for bulky material like full CSP or settings references.	3 / 5
	Total	13 / 20 Passed

Description

66%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description clearly communicates a Django-specific security niche with concrete topic coverage, but it omits any explicit 'Use when...' trigger guidance, which limits completeness. Keyword coverage is good though not exhaustive of the body's actual scope.

Suggestions

Add an explicit 'Use when...' clause listing trigger phrases (e.g., 'Use when configuring Django authentication, hardening production settings, or reviewing a Django app for security issues').

Include synonyms for topics covered in the body that are absent from the description, such as session security, password validation, and API rate limiting.

Rephrase topic nouns as concrete actions where possible (e.g., 'Configure authentication and authorization, prevent CSRF, SQL injection, and XSS') to strengthen specificity.

Dimension	Reasoning	Score
Specificity	Lists several concrete security areas — 'authentication, authorization, CSRF protection, SQL injection prevention, XSS prevention, and secure deployment configurations' — giving comprehensive topic coverage, though phrased as topics rather than concrete verbs.	4 / 5
Completeness	The 'what' is clear (Django security best practices across named areas) but there is no 'Use when...' clause or equivalent explicit trigger guidance, which caps completeness at 3 per the rubric guideline.	3 / 5
Trigger Term Quality	Natural terms users would say ('Django security', 'CSRF', 'SQL injection', 'XSS') are present with good coverage, but synonyms for body-covered topics like sessions, passwords, and rate limiting are missing.	4 / 5
Distinctiveness Conflict Risk	Targets a clear Django-security niche with distinct triggers and only minor overlap risk with a generic web-security or Django skill.	4 / 5
	Total	15 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (593 lines); consider splitting into references/ and linking	Warning

	Total	15 / 16 Passed

Repository: affaan-m/ECC
Path: docs/ja-JP/skills/django-security/SKILL.md
Commit: e04ea0b

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.