Content
46%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The body is a code-dense, largely actionable security reference with good topical organization and a closing checklist. However, it is noticeably overlong with duplicated sections and Django-docs boilerplate, lacks any progressive disclosure (single 640-line file, no references), and offers no sequenced review workflow with validation checkpoints.
Suggestions
Split the skill into one-level-deep reference files (e.g., references/file-uploads.md, references/api-security.md, references/security-headers.md) and keep SKILL.md as a concise overview with clearly signaled links, removing the triple duplication of security-header settings.
Trim content Claude already knows — the default AUTH_PASSWORD_VALIDATORS listing, the getCookie JavaScript boilerplate, and the near-verbatim duplicate file-type validator — down to the non-obvious deltas (min_length 12, magic-byte vs. extension cross-check).
Add an ordered security-review workflow with validation checkpoints (e.g., 1. audit settings.py against the checklist, 2. verify each finding with the referenced snippet, 3. re-run on changes), replacing the purely topic-indexed layout.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | There are several padded or duplicated sections: security headers/settings appear three times ("Core Security Settings", "HTTP Headers", "Security Headers"), the file validation code is duplicated nearly verbatim for python-magic and filetype, and the full getCookie JavaScript plus default AUTH_PASSWORD_VALIDATORS listing restate Django documentation Claude already knows — matching anchor 2 ("noticeably verbose; several unnecessary explanations or padded sections") rather than anchor 3's 'some unnecessary explanation'. | 2 / 5 |
Actionability | Guidance is mostly executable and copy-paste ready (production settings, custom user model, validators, middleware, throttling config), matching anchor 4; it falls short of anchor 5 because of minor gaps such as 'raise ImproperlyConfigured(...)' without an import, 'Response' unimported in protected_view, and 'User' referenced in the Post model without its import context. | 4 / 5 |
Workflow Clarity | The body is organized by topic and ends with a "Quick Security Checklist" table, giving implicit ordering, but there is no sequenced review or hardening procedure and no validation checkpoints — matching anchor 3 ("sequence present but checkpoints missing or implicit"); it is not anchor 4 because a reviewer cannot follow an explicit ordered process with verification steps. | 3 / 5 |
Progressive Disclosure | No bundle files exist and the ~640-line SKILL.md inlines everything — file upload security, API security/rate limiting, and CSP middleware details clearly belong in separate reference files — matching anchor 2 ("content that clearly belongs in separate files is inlined"); the clear section headers keep it above anchor 1, but it is below anchor 3 because no references exist at all to be 'present but not clearly signaled'. | 2 / 5 |
Total | 11 / 20 Passed |