CtrlK
BlogDocsLog inGet started
Tessl Logo

path-safety

服务端路径安全与文件访问编码规范。在编写文件下载路由、Agent 工具(文件读取/目录列出)、数据连接器/Loader、Workspace 路径操作、沙箱配置时使用。

80

Quality

100%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

100%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a lean, highly actionable coding standard: terse rationale, executable BAD/GOOD code, a hierarchy diagram, and a decision checklist, all well-organized without filler. It respects Claude's competence while giving precise guidance.

DimensionReasoningScore

Conciseness

Each rule is a one-line rationale plus terse BAD/GOOD code with no padding or explanation of basic concepts (path traversal, resolve()), so every token earns its place.

3 / 3

Actionability

Provides executable Python with real imports and concrete BAD/GOOD pairs per rule, plus a scenario→must-do checklist table that is copy-paste ready.

3 / 3

Workflow Clarity

Rules are clearly sequenced R1–R6, R5 gives an explicit two-step deployment-guard sequence, and the quick-reference checklist supplies a clear scenario→action decision flow; as a preventive coding standard it does not require the destructive/batch validation checkpoint.

3 / 3

Progressive Disclosure

No bundle files exist and the body is a self-contained, well-organized single standard with a one-level-deep reference-doc list; splitting these cohesive rules across files would reduce usability.

3 / 3

Total

12

/

12

Passed

Description

100%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is concise and well-structured, clearly stating both what the skill provides and when to use it with concrete, natural trigger scenarios. It is specific, complete, and distinct from other skills.

DimensionReasoningScore

Specificity

Lists multiple specific concrete contexts — '文件下载路由、Agent 工具(文件读取/目录列出)、数据连接器/Loader、Workspace 路径操作、沙箱配置' — rather than vague language, matching the anchor for listing several specific concrete actions.

3 / 3

Completeness

Explicitly states what ('服务端路径安全与文件访问编码规范') and when ('在编写…时使用') with an explicit trigger clause, satisfying both halves and avoiding the cap-at-2 guideline for missing 'Use when' guidance.

3 / 3

Trigger Term Quality

Terms like '文件下载路由', 'Agent 工具', 'Loader', and '沙箱配置' are natural phrasings a developer on this codebase would say when reaching for the skill, giving good coverage of relevant triggers.

3 / 3

Distinctiveness Conflict Risk

The niche (server-side path safety / file-access coding standards) is clear with distinct, domain-specific triggers unlikely to fire for unrelated skills.

3 / 3

Total

12

/

12

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
microsoft/data-formulator
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.