skill-security-framing

URL validation and content sanitization for untrusted sources — use when handling external input safely

Quality

71%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/skill-security-framing/SKILL.md

Quality

Content

81%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is a strong, actionable security standard with a clear validated workflow, concrete templates, and good organization; its main weaknesses are minor redundancy in the workflow diagram and a fetch step that is described rather than shown as executable code.

Suggestions

Trim redundancy: either keep the ASCII workflow diagram or the prose restatement, and consider removing 'The Bottom Line' which restates the established flow.

Add an executable fetch example (e.g., a concrete WebFetch call with timeout/size handling) so the fetch step matches the actionability of the URL-validation and transform sections.

If deeper detail exists, surface it as one-level-deep bundled reference files (e.g., a PLATFORM_TRANSFORMS.md) rather than the single out-of-bundle host-adapter pointer, to strengthen progressive disclosure.

Dimension	Reasoning	Score
Conciseness	The body is largely efficient with direct rules, tables, and copy-paste templates, though the ASCII workflow diagram restates steps later detailed in prose and 'The Bottom Line' repeats the flow, fitting anchor 4; not 5 because of these minor redundancies, not 3 because padding is minimal.	4 / 5
Actionability	Provides concrete reject patterns, exact Twitter-to-FxTwitter input/output transforms, and a full copy-paste security frame template, matching anchor 4; not 5 because the fetch step is described rather than given as executable code, leaving a minor gap.	4 / 5
Workflow Clarity	A clear four-step sequence with URL validation as an explicit gate before fetching, plus error-handling feedback loops (reject / retry / skip) and an integration checklist, matching anchor 5; not 4 because checkpoints and recovery paths are explicit.	5 / 5
Progressive Disclosure	A single well-organized file with clear section headers and a one-level pointer to a host-adapter doc, fitting anchor 4; not 5 because there are no bundled reference files splitting detail one level deep, and the lone path reference points outside the skill bundle.	4 / 5
	Total	17 / 20 Passed

Description

62%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is clear and explicit with a proper 'use when' trigger and concrete domain language, but it lists only two actions and has moderate keyword coverage rather than comprehensive, synonym-rich triggers.

Suggestions

Expand the action list beyond 'URL validation and content sanitization' (e.g., 'reject dangerous hosts, transform platform URLs, wrap fetched content in a security frame') to lift specificity toward 5.

Add natural trigger synonyms users might say, such as 'untrusted URLs, external input, prompt injection, fetched content, SSRF prevention', to improve trigger-term coverage.

Make the 'when' clause more concrete with explicit trigger phrases (e.g., 'Use when fetching, analyzing, or passing external/untrusted content to subagents').

Dimension	Reasoning	Score
Specificity	Names the domain and two concrete actions ('URL validation and content sanitization') but does not enumerate several specific actions, matching anchor 3; it is not 4 because coverage is limited to two actions rather than a fuller list.	3 / 5
Completeness	Clearly states what it does ('URL validation and content sanitization for untrusted sources') and gives an explicit 'use when handling external input safely' trigger, matching anchor 4; not 5 because the 'when' clause is concise rather than enumerating concrete trigger phrases.	4 / 5
Trigger Term Quality	Includes relevant natural terms like 'untrusted sources' and 'external input' but misses common variations, synonyms, or file-extension-style triggers, fitting anchor 3; not 4 because keyword coverage is not broad.	3 / 5
Distinctiveness Conflict Risk	The untrusted-source / external-input niche is mostly distinct with only minor overlap risk against general content-handling skills, matching anchor 4; not 5 because the triggers are not maximally specific to a single narrow workflow.	4 / 5
	Total	14 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: nyldn/claude-octopus
Path: skills/skill-security-framing/SKILL.md
Commit: 242e51d

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.