skill-security-framing

URL validation and content sanitization for untrusted sources — use when handling external input safely

Quality

81%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Quality

Content

77%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with clear, validated workflows and copy-paste templates. Its main weaknesses are length/redundancy and a monolithic single-file structure with no progressive disclosure into bundle references.

Suggestions

Trim redundancy: remove or condense the ASCII workflow box, the worked example, and 'The Bottom Line' recap since they restate the same flow already detailed in the sections.

Move the verbose URL validation rules and the full security-frame template into reference files (e.g. references/url-validation.md, references/security-frame.md) and link to them one level deep from SKILL.md.

Drop the host-adapter preamble or relocate it to a host-adapter reference so SKILL.md stays focused on the security-framing substance.

Dimension	Reasoning	Score
Conciseness	Largely concrete operational rules rather than concept explanation, but the ~280-line body carries redundancy — an ASCII workflow diagram, a worked example, and 'The Bottom Line' recap all restate the same five-step flow, plus a host-adapter preamble that is not part of the skill's substance.	2 / 3
Actionability	Provides copy-paste-ready, fully executable material: exact reject patterns, a literal FxTwitter input/output transform, the complete security-frame markdown template, a size-limit table, and concrete error-handling message templates.	3 / 3
Workflow Clarity	The multi-step flow is explicitly sequenced (URL validate → fetch → frame → analyze → sanitize) with visible validation checkpoints ('✓ Protocol', '✓ Hostname', '✓ Length') and feedback loops via error-handling options, plus an integration checklist.	3 / 3
Progressive Disclosure	No bundle files exist and all content sits inline in a single ~280-line file; sections like the URL validation rules and the security-frame template are well-organized but could appropriately be split into one-level-deep reference files rather than kept monolithic.	2 / 3
	Total	10 / 12 Passed

Description

85%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description that clearly states its capabilities and an explicit use-when trigger with good distinctiveness. It would benefit from a broader set of natural trigger terms a user might actually say.

Suggestions

Broaden trigger coverage with concrete phrasings users say, e.g. 'sanitize input', 'validate URLs/links', or 'prevent prompt injection' alongside 'external input'.

Optionally name a third concrete action (e.g. 'prompt-injection defense') to push specificity even further past the two-action baseline.

Dimension	Reasoning	Score
Specificity	Names multiple concrete actions — 'URL validation' and 'content sanitization' — applied to a specific object ('untrusted sources'), matching the multiple-concrete-actions anchor rather than the single-action level 2.	3 / 3
Completeness	Explicitly states both what it does ('URL validation and content sanitization for untrusted sources') and when to use it ('use when handling external input safely'), matching the level-3 what-and-when anchor.	3 / 3
Trigger Term Quality	Includes relevant natural terms like 'untrusted sources', 'external input', and an explicit 'use when' trigger, but lacks common variations a user might actually say (e.g. 'sanitize input', 'validate links', 'prevent prompt injection').	2 / 3
Distinctiveness Conflict Risk	Targets a clear niche (security framing for external/untrusted content) with distinct triggers unlikely to fire for unrelated skills.	3 / 3
	Total	11 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: nyldn/claude-octopus
Path: .claude/skills/skill-security-framing/SKILL.md
Commit: 9f39f0c

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.