CtrlK
BlogDocsLog inGet started
Tessl Logo

path-safety

服务端路径安全与文件访问编码规范。在编写文件下载路由、Agent 工具(文件读取/目录列出)、数据连接器/Loader、Workspace 路径操作、沙箱配置时使用。

70

Quality

85%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

82%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a tight, highly actionable set of path-safety coding rules with executable BAD/GOOD examples and a useful checklist. It is efficient and well-structured, with only minor redundancy and no explicit verification checkpoint.

Suggestions

Add an explicit verification step to the checklist (e.g. 'after adding a Loader, confirm it is absent from DATA_LOADERS when WORKSPACE_BACKEND != local') to close the validation gap for risky changes.

Consider trimming the ASCII '已有安全 API 的层次关系' diagram since its content is already conveyed by R4's prose and the checklist.

Make the 参考文档 entries into markdown links or note which section each cited doc elaborates, so the one-level-deep references are clearly signaled for navigation.

DimensionReasoningScore

Conciseness

Lean rule-based body with one-line rationales and minimal BAD/GOOD snippets that assumes Claude's competence; the ASCII '层次关系' diagram and the checklist table add minor redundancy that could be trimmed.

4 / 5

Actionability

Every rule supplies copy-paste-ready BAD/GOOD Python using real APIs (ConfinedDir.resolve, send_file, _enforce_deployment_restrictions) plus concrete env-guard and registration steps, covering the common cases.

5 / 5

Workflow Clarity

A 速查 checklist table routes scenarios to required actions and R5 gives a numbered registration sequence, providing clear checkpoints; minor gap is the absence of an explicit validate/verify step for newly added loaders or sandbox configs.

4 / 5

Progressive Disclosure

Well-organized into six labeled rule sections plus a checklist and a one-level-deep 参考文档 list; no bundle files exist so all content is inlined, and references are plain repo paths rather than navigable progressive-disclosure bundles.

4 / 5

Total

17

/

20

Passed

Description

87%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is well-crafted: it states a clear purpose and pairs it with an explicit, scenario-based 'use when' clause covering the skill's main application areas. Trigger terms are natural and the niche is distinct.

DimensionReasoningScore

Specificity

Names the domain ('服务端路径安全与文件访问编码规范') and enumerates several concrete application contexts (文件下载路由, Agent 工具, 数据连接器/Loader, Workspace 路径操作, 沙箱配置), going well beyond 1–2 actions but listing where-to-use rather than the discrete actions the skill performs.

4 / 5

Completeness

Explicitly answers both 'what' (服务端路径安全与文件访问编码规范) and 'when' ('在编写...时使用' with a concrete list of trigger scenarios), matching the anchor that requires concrete trigger phrases for both.

5 / 5

Trigger Term Quality

Includes natural developer-facing trigger phrases like '文件下载路由', 'Agent 工具(文件读取/目录列出)', '数据连接器/Loader', 'Workspace 路径操作', and '沙箱配置', with good but not exhaustive coverage (e.g. omits 'path traversal/LFI' and 'send_file').

4 / 5

Distinctiveness Conflict Risk

Occupies a clear niche (server-side path-safety coding rules for file-access code) with distinct, specific triggers and minimal overlap with other skills.

5 / 5

Total

18

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
microsoft/data-formulator
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.