django-security

Django security best practices, authentication, authorization, CSRF protection, SQL injection prevention, XSS prevention, and secure deployment configurations.

Quality

63%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./.kiro/skills/django-security/SKILL.md

Quality

Content

65%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable, packed with executable Django security code and clear good/bad contrasts. Its weaknesses are redundancy and one conflicting setting across sections, the absence of a validated deployment workflow, and a monolithic structure that would benefit from splitting detailed references into separate files.

Suggestions

Consolidate the duplicated security-header configuration (currently spread across Core Settings, XSS Prevention, and Security Headers) into a single authoritative block to remove the CSRF_COOKIE_HTTPONLY True/False conflict.

Add a short, sequenced 'Production deployment hardening' workflow with explicit validation checkpoints (e.g., run check --deploy, verify SECRET_KEY/DEBUG, re-check) to raise workflow clarity above 3.

Move the longer reference material (e.g., full DRF throttle/auth configs, CSP middleware, logging config) into separate reference files linked from SKILL.md to improve progressive disclosure.

Dimension	Reasoning	Score
Conciseness	The body is mostly terse code with brief inline comments and little concept over-explanation, but it repeats several blocks (security headers appear in Core Settings, the XSS section, and the Security Headers section) and contains a conflicting CSRF_COOKIE_HTTPONLY value (True in core settings vs. False in the CSRF section), so it is efficient overall yet could be tightened and de-duplicated.	3 / 5
Actionability	It provides fully executable, copy-paste-ready Django settings, models, mixins, and DRF code with explicit GOOD/BAD contrasts covering the common cases, matching the 'fully executable; copy-paste ready code' anchor.	5 / 5
Workflow Clarity	It is a reference catalog with a useful 'When to Activate' list and a Quick Security Checklist, but there is no sequenced multi-step process with validation checkpoints or a validate→fix→retry feedback loop for risky operations like production deployment, so it sits at the 'steps listed but checkpoints missing' level.	3 / 5
Progressive Disclosure	It has well-organized section headers but is a single ~590-line monolithic file with all content inlined and no bundle files or one-level-deep references, so it cannot reach the simple-skill exception of 5 and lands at 'some structure but content that should be separate is inline'.	3 / 5
	Total	14 / 20 Passed

Description

62%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and clearly distinguishable, naming concrete Django security domains with minimal conflict risk. Its main weakness is the absence of an explicit 'Use when...' trigger clause, which caps completeness and limits trigger-term quality.

Suggestions

Add an explicit 'Use when...' clause naming concrete user triggers, e.g. 'Use when securing a Django app, configuring authentication/authorization, hardening production settings, or reviewing a Django codebase for vulnerabilities.'

Include natural user phrasings and synonyms such as 'Django app', 'Django project', and 'web app security' to broaden trigger-term coverage.

Consider mentioning file extension or framework-version cues (e.g., 'settings.py', 'Django 4.x+') to sharpen trigger distinctiveness further.

Dimension	Reasoning	Score
Specificity	Names the domain (Django security) and lists several concrete capability areas — 'authentication, authorization, CSRF protection, SQL injection prevention, XSS prevention, and secure deployment configurations' — with only minor coverage gaps, matching the 'lists several specific actions' anchor rather than the fully comprehensive anchor 5.	4 / 5
Completeness	It clearly states what the skill covers but contains no 'Use when...' clause or equivalent explicit trigger guidance, so per the rubric a missing explicit 'when' caps completeness at 3.	3 / 5
Trigger Term Quality	It includes relevant natural terms like 'Django security', 'CSRF protection', and 'authentication', but it misses common synonyms and phrasings a user would actually say (e.g., 'Django app', 'Django project', 'web app security') and has no 'Use when...' phrasing, placing it between anchors 3 and 4 and closer to 3.	3 / 5
Distinctiveness Conflict Risk	'Django security best practices' carves out a clear niche with distinct triggers (Django-specific security concerns) and minimal overlap with other skills, matching the 'clear niche with distinct triggers' anchor.	5 / 5
	Total	15 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (594 lines); consider splitting into references/ and linking	Warning
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	14 / 16 Passed

Repository: affaan-m/everything-claude-code
Path: .kiro/skills/django-security/SKILL.md
Commit: d8409a4

Reviewed: 1 day ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.