django-security

Django security best practices, authentication, authorization, CSRF protection, SQL injection prevention, XSS prevention, and secure deployment configurations. Use when reviewing Django authentication, authorization, input handling, or deployment settings.

Quality

78%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/django-security/SKILL.md

Quality

Content

65%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A thorough, highly actionable Django security reference weighed down by monolithic structure and duplicated security-header blocks, and lacking explicit validation workflows for its riskier operations.

Suggestions

Deduplicate security-header configuration by defining it once and cross-referencing, instead of repeating SECURE_CONTENT_TYPE_NOSNIFF / X_FRAME_OPTIONS / CSP blocks across three sections.

Split the per-topic code references (auth, authorization, CSRF, file uploads, API security) into reference files under ./references/ and keep SKILL.md as a concise overview with one-level-deep links.

Add an explicit validation/verification workflow (e.g., a deployment-hardening checklist with run `python manage.py check --deploy` and fix-retry steps) to turn the checklist into a real feedback loop.

Dimension	Reasoning	Score
Conciseness	Mostly code-dense and free of beginner-concept padding, but security-header configuration (SECURE_CONTENT_TYPE_NOSNIFF, X_FRAME_OPTIONS, CSP) is repeated across the production settings, XSS HTTP headers, and dedicated Security Headers sections, inflating the token budget.	3 / 5
Actionability	Provides copy-paste-ready settings, models, views, middleware, and validators covering the common cases, with clear GOOD/BAD contrasts for injection and XSS patterns.	5 / 5
Workflow Clarity	This is a reference catalog rather than a sequenced workflow; the closing Quick Security Checklist supplies some structure, but there are no explicit validation checkpoints or validate-fix-retry feedback loops for the destructive/batch operations it touches (e.g., deployment settings, file uploads).	3 / 5
Progressive Disclosure	Internal section organization is clear, but ~640 lines of reference material that would benefit from separate files is inlined into one monolithic SKILL.md with no bundle files or external references.	3 / 5
	Total	14 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that clearly states what the skill covers and when to use it, with concrete trigger phrases and minimal conflict risk. The only minor gap is trigger-term synonym coverage.

Dimension	Reasoning	Score
Specificity	Lists six concrete, distinct security practices ('authentication, authorization, CSRF protection, SQL injection prevention, XSS prevention, and secure deployment configurations'), giving comprehensive coverage of the domain rather than vague abstraction.	5 / 5
Completeness	Explicitly answers both 'what' (the listed security practices) and 'when' ('Use when reviewing Django authentication, authorization, input handling, or deployment settings') with concrete trigger phrases.	5 / 5
Trigger Term Quality	Natural phrases a user would say ('reviewing Django authentication', 'authorization', 'input handling', 'deployment settings') are present, but coverage of synonyms/variations is good rather than exhaustive.	4 / 5
Distinctiveness Conflict Risk	Scoped tightly to Django security with distinct triggers, making it unlikely to fire for unrelated skills.	5 / 5
	Total	19 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (645 lines); consider splitting into references/ and linking	Warning
metadata_version	'metadata.version' is missing	Warning

	Total	14 / 16 Passed

Repository: affaan-m/ECC
Path: skills/django-security/SKILL.md
Commit: d8409a4

Reviewed: 1 day ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.