CtrlK
BlogDocsLog inGet started
Tessl Logo

skill-security-framing

URL validation and content sanitization for untrusted sources — use when handling external input safely

55

Quality

63%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./.claude/skills/skill-security-framing/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

63%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable with concrete validation rules, templates, and a clear workflow, but it is a padded monolithic file that would benefit from trimming redundant sections and splitting detailed material into reference files.

Suggestions

Remove the decorative ASCII workflow box and the redundant "Bottom Line" section, since the steps are already detailed in the body.

Split the security-frame template and platform-specific transforms into separate reference files (e.g., references/security-frame.md, references/platform-transforms.md) and link to them from the overview.

Add an explicit validate→fix→retry feedback loop (e.g., on URL validation failure, surface the reject reason and re-prompt) to strengthen workflow clarity.

DimensionReasoningScore

Conciseness

The body is mostly actionable reference material, but the decorative ASCII workflow box restates the steps already detailed below and the "Bottom Line" section repeats the pipeline, padding that could be trimmed.

3 / 5

Actionability

Provides concrete reject lists, specific platform transforms with input/output, and a copy-paste security-frame template, but offers no executable validation script — only rules and templates, leaving minor gaps.

4 / 5

Workflow Clarity

A clear four-step sequence (validate → fetch → frame → analyze) is reinforced with an integration checklist and error-handling templates, but there is no explicit validate→fix→retry feedback loop.

4 / 5

Progressive Disclosure

Sections are well-organized, but the skill is a monolithic ~280-line file with no bundle files and no external references, so content that could be split (frame template, platform transforms) is inlined.

3 / 5

Total

14

/

20

Passed

Description

62%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description cleanly covers both what the skill does and when to use it within a single concise sentence, but its trigger phrasing is generic and its action list is narrow.

Suggestions

Add concrete trigger phrases users would naturally say (e.g., "when the user pastes a link, shares a URL, or asks to fetch/analyze a webpage").

Expand the action list beyond two verbs to reflect full coverage (e.g., validate URLs, fetch safely, sanitize/wrap content, neutralize prompt injection).

Include common synonyms/extensions ("links", "web pages", "untrusted content", "external input") to improve trigger-term coverage.

DimensionReasoningScore

Specificity

Names the domain and two concrete actions ("URL validation" and "content sanitization") but offers no further breadth, matching the anchor for 1-2 concrete actions that is not comprehensive.

3 / 5

Completeness

Explicitly states what ("URL validation and content sanitization for untrusted sources") and when ("use when handling external input safely"), but the trigger clause is generic rather than concrete, so it stops short of the top anchor.

4 / 5

Trigger Term Quality

Includes relevant terms ("URL validation", "content sanitization", "external input") but lacks common synonyms and variations a user might naturally say, fitting the "some relevant keywords but missing variations" anchor.

3 / 5

Distinctiveness Conflict Risk

Targets a clear security-utility niche with distinct triggers, with only minor overlap risk against general content-fetching skills, matching the "mostly distinct" anchor.

4 / 5

Total

14

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository
nyldn/claude-octopus
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.