django-security

Django security best practices, authentication, authorization, CSRF protection, SQL injection prevention, XSS prevention, and secure deployment configurations.

Quality

73%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./.kiro/skills/django-security/SKILL.md

Quality

Content

65%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, code-rich Django security reference with clear section organization, but it is presented as a monolithic ~590-line inline dump with no progressive disclosure or sequenced validation workflow. Splitting reference material into bundled files and adding an explicit hardening workflow would raise the weaker dimensions.

Suggestions

Move large reference catalogs (e.g. the settings, hasher, throttle, and CSP sections) into bundled reference files under references/ and link to them one level deep from SKILL.md.

Add a sequenced hardening workflow with explicit validation checkpoints (e.g. run security checks / deploy / verify headers) so the skill guides a multi-step process rather than only listing configs.

Trim redundant commentary to tighten the inline overview toward the lean anchor expected of a SKILL.md body.

Dimension	Reasoning	Score
Conciseness	The ~590-line body is mostly concrete settings and code with terse comments rather than explanations of basic concepts, but it is a long inline reference dump that could be tightened and split; not verbose enough for a 1, not lean enough for a 3.	2 / 3
Actionability	It provides fully executable, copy-paste-ready code throughout (production settings, custom user model, permissions, middleware, validators), matching the anchor for specific examples that are ready to use.	3 / 3
Workflow Clarity	The skill is a reference catalog of independent config snippets rather than a sequenced process; the closing checklist gives some structure but there are no explicit validation checkpoints or fix-retry feedback loops, so it sits at 2.	2 / 3
Progressive Disclosure	Content is organized into clearly headed sections, but it is a monolithic single-file wall of reference material with no bundle files or one-level-deep references; content that should be separate (settings catalogs, API throttle reference) is inline.	2 / 3
	Total	9 / 12 Passed

Description

82%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A specific, third-person description that names concrete Django security capabilities and natural trigger terms, with a clear niche that avoids conflicts. Its main weakness is the absence of an explicit 'Use when...' clause, which caps completeness.

Suggestions

Add an explicit trigger clause, e.g. 'Use when configuring Django authentication/authorization, hardening production settings, or reviewing a Django app for security issues.'

Include common phrasings users might say such as 'Django security hardening' or 'secure Django deployment' to broaden trigger coverage.

Dimension	Reasoning	Score
Specificity	The description lists multiple concrete capabilities ('authentication, authorization, CSRF protection, SQL injection prevention, XSS prevention, and secure deployment configurations'), matching the anchor for listing multiple specific concrete actions rather than vague language.	3 / 3
Completeness	It clearly states what the skill covers but provides no 'Use when...' clause or equivalent explicit trigger guidance, so per the judging guidelines completeness is capped at 2 even though the 'what' is strong.	2 / 3
Trigger Term Quality	It includes natural terms a user would actually say ('Django security', 'CSRF', 'SQL injection', 'XSS', 'authentication'), giving good coverage of natural keywords rather than only technical jargon.	3 / 3
Distinctiveness Conflict Risk	The description targets a clear Django-specific niche with distinct triggers, making it unlikely to fire for unrelated skills; it is not generic like 'Helps with code and documents'.	3 / 3
	Total	11 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (593 lines); consider splitting into references/ and linking	Warning

	Total	15 / 16 Passed

Repository: affaan-m/ECC
Path: .kiro/skills/django-security/SKILL.md
Commit: 0c1d7be

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.