security

MUST be used whenever fixing security issues in a Flows app, or before shipping any feature that handles credentials, user input, or external data. This skill finds AND fixes security problems — it does not just report them. Do NOT skip this when the user asks for a security fix, security hardening, or vulnerability remediation — run every step in order. Triggers: security, security fix, security hardening, vulnerability, XSS, injection, credentials, secrets, auth, authentication, authorization, token, sensitive data, input validation, CORS, CSP, dependency audit.

1.07x

Quality

77%

Does it follow best practices?

Impact

97%

1.07x

Average score across 1 eval scenario

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/security/SKILL.md

Quality

Content

68%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A thorough, highly actionable 9-step security-fix workflow with concrete grep commands and copy-paste fix code. Its main gap is the absence of validation/verification checkpoints for a batch code-modification process, and a couple of fixes (notably auth guards) are descriptive rather than executable.

Suggestions

Add an explicit validation checkpoint after the fix steps — e.g. re-run the Step 2/3/4/6 greps to confirm no matches remain, run `pnpm audit` again, and run the build/tests — before Step 9 reporting; this would lift workflow_clarity above the missing-validation cap of 3.

Provide a concrete copy-paste auth-guard wrapper component in Step 5 instead of the descriptive instruction, to close the actionability gap.

Consider moving the per-pattern fix tables or the vite CSP header reference into a references/ file to improve progressive disclosure for this longer skill.

Dimension	Reasoning	Score
Conciseness	The body is mostly efficient grep commands, fix tables, and copy-paste code with little concept explanation Claude doesn't need; a few sections (e.g. the "What is acceptable" list and repeated "How to fix" framing) could be trimmed, matching the efficient-with-minor-over-explanation anchor.	4 / 5
Actionability	Most guidance is executable — concrete grep patterns, DOMPurify/Zod/vite-config code blocks — but the Step 5 auth-guard fix is descriptive ("ensure the route element is wrapped in a component that checks...") rather than copy-paste code, leaving a minor gap below the fully-executable anchor.	4 / 5
Workflow Clarity	Nine numbered steps give a clear sequence, but this batch/destructive code-modification skill has no validation/verification checkpoint (no re-grep, test run, build check, or re-audit) between fixing and the final report, so the missing-validation cap at 3 applies.	3 / 5
Progressive Disclosure	Content is well-organized into clearly-headed steps with cohesive inline fix guidance and no nested-reference problem; it stays just below 5 only because no material is split into reference files, which a 240-line skill could benefit from.	4 / 5
	Total	15 / 20 Passed

Description

86%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description that clearly states both what the skill does and when to use it, with a comprehensive trigger-term list and a well-scoped niche. Its only weakness is that the named actions (find/fix) are generic rather than enumerating the specific security fixes the skill performs.

Suggestions

Add 1-2 specific concrete actions to the description (e.g. "migrate raw CDF calls to the SDK, sanitize dangerous DOM APIs, add Zod input validation") to lift specificity from generic find/fix to comprehensive coverage.

Consider whether the broad trigger terms (security, auth, credentials) need a qualifier like "in a Flows/CDF app" inline to further reduce overlap risk with a general security skill.

Dimension	Reasoning	Score
Specificity	Names the security domain and the concrete actions "finds AND fixes security problems", but the actions stay generic rather than enumerating specific fixes (e.g. sanitize XSS, migrate to SDK), matching the anchor for domain + 1-2 actions without comprehensive coverage.	3 / 5
Completeness	It explicitly states what ("finds AND fixes security problems — it does not just report them") and when ("MUST be used whenever fixing security issues in a Flows app..." plus an explicit Do-NOT-skip trigger list), satisfying the anchor for clearly answering both what and when with concrete trigger phrases.	5 / 5
Trigger Term Quality	The explicit Triggers list covers a comprehensive set of natural terms and synonyms users would say (security/security fix/security hardening, auth/authentication, credentials/secrets, XSS/injection, CORS/CSP), matching the comprehensive-coverage anchor.	5 / 5
Distinctiveness Conflict Risk	Scoping to "a Flows app" and CDF/Cognite-specific triggers gives it a clear niche with minimal conflict risk, but broadly-used terms like security/auth/credentials carry minor overlap with a hypothetical general security skill, so it sits just below the minimal-conflict anchor.	4 / 5
	Total	17 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
allowed_tools_field	'allowed-tools' contains unusual tool name(s)	Warning
metadata_version	'metadata.version' is missing	Warning

	Total	14 / 16 Passed

Repository: cognitedata/builder-skills
Path: skills/security/SKILL.md
Commit: c87160a

Reviewed: 5 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.