security-sandbox

Secure command execution with allowlists and validation hooks. Use when validating bash commands, configuring security policies, implementing pre-tool-use hooks, or sandboxing autonomous agent operations.

Quality

76%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/security-sandbox/SKILL.md

Quality

Content

61%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is actionable and well-organized with verified references, but token bloat (ASCII diagram, inlined allowlist) and the absence of an explicit validation workflow for a destructive-command skill hold back conciseness and workflow clarity.

Suggestions

Move the ASCII 'Defense in Depth' diagram into references/SECURITY-MODEL.md and replace it with a one-line summary to cut tokens.

Replace the inlined default allowlist and dangerous-patterns table with a pointer to references/ALLOWED-COMMANDS.md, keeping only a minimal inline example.

Add a sequenced workflow with an explicit validation checkpoint (e.g., validate command → if blocked, log and escalate; else execute) to satisfy the destructive-operation feedback-loop requirement.

Dimension	Reasoning	Score
Conciseness	Mostly efficient but padded by the large ASCII 'Defense in Depth' diagram and an inlined default allowlist that mostly restates file contents Claude could read on demand.	3 / 5
Actionability	Provides copy-paste-ready Python snippets for validation, hooks, and allowlist management plus a dangerous-patterns table, with only minor gaps (the hook example elides the full async call signature).	4 / 5
Workflow Clarity	Presents disjoint usage snippets rather than a sequenced validate→decide→log feedback loop; for a destructive-command-blocking skill the missing explicit validation/verification workflow caps this at 3.	3 / 5
Progressive Disclosure	References and scripts are real one-level-deep files, clearly listed and well-signaled, with content appropriately split — though the inlined allowlist/dangerous-patterns table slightly duplicates references/ALLOWED-COMMANDS.md.	4 / 5
	Total	14 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is precise, well-structured, and clearly answers both what the skill does and when to invoke it. Only minor keyword-synonym coverage keeps trigger term quality from the top anchor.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'validating bash commands, configuring security policies, implementing pre-tool-use hooks, or sandboxing autonomous agent operations' — giving comprehensive coverage of the skill's capabilities.	5 / 5
Completeness	Explicitly states both the 'what' (secure command execution with allowlists and validation hooks) and the 'when' (a 'Use when...' clause with concrete trigger phrases).	5 / 5
Trigger Term Quality	Strong natural terms ('validating bash commands', 'security policies', 'pre-tool-use hooks', 'sandboxing') but a few common synonyms like 'command allowlist' or 'guardrails' are absent, so it falls just short of comprehensive.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (security sandboxing / command validation / hooks) with distinct triggers and minimal overlap risk against general coding skills.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: fernandezbaptiste/Skrillz
Path: skills/security-sandbox/SKILL.md
Commit: 93ed392

Reviewed: 1 day ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.