CtrlK
BlogDocsLog inGet started
Tessl Logo

security-best-practices

Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks.

84

1.18x
Quality

76%

Does it follow best practices?

Impact

97%

1.18x

Average score across 3 eval scenarios

SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./bundled/skills/security-best-practices/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

65%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is a well-organized overview that correctly delegates detailed security guidance to a real, well-structured references bundle, with clear workflow sequencing and concrete report/fix expectations. Its main weaknesses are overlap between the Workflow and Decision Tree sections and the absence of an explicit validation feedback loop in the fix workflow.

Suggestions

Collapse the overlap between the Workflow and Workflow Decision Tree sections into a single concise flow to remove redundancy.

Add an explicit validate→fix→re-validate checkpoint to the Fixes workflow (e.g., run the project's tests after each fix and only proceed when they pass) so destructive changes have a hard feedback loop.

Tighten the long "Always consider..." sentences in the Fixes section into shorter imperative bullets.

DimensionReasoningScore

Conciseness

The body is mostly efficient and avoids over-explaining basic concepts, but the Workflow and Workflow Decision Tree sections overlap heavily and several "Always consider..." sentences run longer than necessary, so it could be tightened.

3 / 5

Actionability

Provides concrete guidance: a filename pattern for locating reference files, a report structure with numeric IDs and required line numbers, and explicit commit/test flow expectations, with only minor gaps (no code examples, which is acceptable for an instruction skill).

4 / 5

Workflow Clarity

The sequence (identify languages/frameworks → load references → choose mode → report/fix) is clear and a decision tree is present, but the fix workflow lacks an explicit validate-then-retry checkpoint; it only gestures at regressions and testing rather than a hard validation loop, which caps destructive/batch fix operations.

3 / 5

Progressive Disclosure

The body is a concise overview that points one level deep to real reference files via a documented filename pattern; bulk security detail lives in the references/ bundle, which is clearly signaled and easy to navigate.

5 / 5

Total

15

/

20

Passed

Description

87%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is explicit about both what the skill does and when it should trigger, with strong boundary guidance that minimizes conflict with other skills. Its only weakness is slightly high-level capability phrasing and a few missing natural synonyms.

DimensionReasoningScore

Specificity

Names the security domain and several concrete actions ("security best-practice reviews", "suggest improvements", "secure-by-default coding help"), but stays at a moderately high level without enumerating specific review techniques, leaving minor coverage gaps.

4 / 5

Completeness

Clearly states what it does (security best-practice reviews, suggest improvements, secure-by-default coding) and provides explicit, concrete trigger guidance ("Trigger only when...") including language scoping and exclusion of non-security tasks.

5 / 5

Trigger Term Quality

Includes natural trigger phrases ("security best practices guidance", "security review/report", "secure-by-default coding help") plus explicit language names, but omits common synonyms like "vulnerability" or "pentest".

4 / 5

Distinctiveness Conflict Risk

The explicit "Do not trigger for general code review, debugging, or non-security tasks" boundary combined with language scoping gives it a clear niche with minimal conflict risk.

5 / 5

Total

18

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
foryourhealth111-pixel/Vibe-Skills
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.