Content
68%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The content is well-structured, lean, and highly concrete — a Claude agent following it would know exactly what files to produce. However, the skill systematically teaches dangerous patterns as 'Key Principles': SQL built by concatenating user input (SQL injection), a hardcoded JWT secret with middleware that swallows verification failures, base64 presented as password hashing, plaintext password logging, eval() on request bodies, and exec() on a user-controlled filename (command injection). These are correctness-breaking in ordinary use and severe security defects; the workflow also lacks any validation or test checkpoint. The scores above reflect the rubric's dimensions (conciseness, actionability, workflow clarity, structure), but this skill should not ship in its current form regardless of those scores.
Suggestions
Replace all string-concatenated SQL with better-sqlite3 prepared statements and parameter binding, and delete the 'String concatenation for SQL is fine' principle — it breaks on quotes and enables SQL injection.
Fix the authentication guidance: generate the JWT secret from configuration/environment rather than hardcoding it, return 401 on verification failure instead of `next()` in the catch block, use a real password hash (bcrypt/scrypt) instead of base64, and never log passwords in console.log.
Remove eval() from /tasks/import (parse JSON with JSON.parse) and remove the exec() call in /tasks/export that interpolates a user-supplied filename into a shell command; then add an explicit workflow step to compile and smoke-test the generated server (e.g. tsc + hit /api/tasks) as a validation checkpoint.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is efficient: minimal prose, well-labeled sections, and the bulk is template code appropriate for a generator skill — matching anchor 4 ('Efficient; minor instances of over-explanation that could be trimmed'). It is not anchor 5 because parts of 'Key Principles' and inline comments restate what the code already shows (e.g. 'console.log is sufficient for logging'), and not anchor 3 because there is no padding explaining concepts Claude already knows. | 4 / 5 |
Actionability | Concrete, near copy-paste-ready TypeScript is given for every file (db, auth, routes, index) covering the common cases (CRUD, login, export), matching anchor 4. It falls short of anchor 5 because the taught patterns are not robustly executable in practice: string-concatenated SQL breaks on inputs containing quotes, auth.ts mixes `require` with ES imports, and `eval()` on request bodies produces broken behavior on ordinary JSON input — concrete guidance with real gaps in correct execution. | 4 / 5 |
Workflow Clarity | A rough sequence exists (project setup → file list → per-file code patterns → principles), but there are no validation or verification checkpoints anywhere (no build, run, or test step). Per the rubric's scoring notes, database operations and destructive endpoints (DELETE /tasks/:id) without feedback loops cap workflow_clarity at 3, matching anchor 3 ('sequence present but checkpoints missing or implicit'). | 3 / 5 |
Progressive Disclosure | The single-file layout is well organized: one clearly headed section per source file plus setup and principles, making it easy to navigate — matching anchor 4 ('Good structure; most content is appropriately placed; minor organization gaps'). It does not reach anchor 5 because at ~210 lines the full implementation is monolithic with no references/ split for the larger templates, and there is no references structure to evaluate beyond the single file. | 4 / 5 |
Total | 15 / 20 Passed |