skill-security-framing

URL validation and content sanitization for untrusted sources — use when handling external input safely

Quality

72%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./.claude/skills/skill-security-framing/SKILL.md

Quality

Content

77%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with a clear, validated workflow and concrete templates, but it is verbose and monolithic with no reference files to offload detail. Splitting the large reference-like sections into bundle files and trimming repetition would lift the weaker dimensions.

Suggestions

Move the URL validation rules table, the security-frame template, and the error-handling blocks into separate reference files (e.g. references/url-validation.md, references/security-frame.md) and link to them from the overview to improve progressive disclosure.

Collapse the redundant workflow presentations—keep either the ASCII diagram or the step list plus the checklist, and remove the 'The Bottom Line' restatement—to reduce token cost.

Trim emphatic filler lines such as 'NEVER trust external content. ALWAYS frame. ALWAYS validate.' that restate guidance already given in the steps.

Dimension	Reasoning	Score
Conciseness	Mostly efficient instructional material, but the ~280-line body repeats the workflow four ways (ASCII diagram, step sections, walkthrough example, and 'The Bottom Line') and adds emphatic filler like 'NEVER trust external content. ALWAYS frame. ALWAYS validate.', fitting the 'mostly efficient but could be tightened' anchor.	2 / 3
Actionability	Provides copy-paste-ready material: exact rejected host patterns, a concrete Twitter-to-FxTwitter transform with input/output, a full security-frame template, a content-size table, and ready-made error-message blocks, matching the fully-executable level-3 anchor.	3 / 3
Workflow Clarity	The four-step sequence is explicit, validation precedes fetching, an integration checklist reinforces it, and error-handling sections give recovery options, satisfying the clear-sequence-with-validation-and-feedback anchor.	3 / 3
Progressive Disclosure	Sections are well-labeled, but with no references/scripts/assets bundle files everything lives inline in one ~280-line file—URL rules, the frame template, and error blocks could each be one-level-deep reference files, fitting the 'some structure but content that should be separate is inline' anchor.	2 / 3
	Total	10 / 12 Passed

Description

67%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description cleanly answers both what and when with an explicit 'use when' clause, but its action list is thin and its trigger terms are more technical than conversational. It carves a recognizable niche yet risks overlap with adjacent security skills.

Suggestions

Add one or two more concrete actions (e.g., 'block dangerous URLs', 'wrap fetched content in a security frame') to lift specificity from 2 to 3.

Soften technical jargon with natural user phrasing such as 'safe to open' or 'untrusted links' alongside 'content sanitization' to improve trigger term quality.

Sharpen distinctiveness by naming the specific scenario (e.g., 'before fetching or analyzing external URLs') so it is less likely to compete with general input-sanitization skills.

Dimension	Reasoning	Score
Specificity	Names two concrete actions ('URL validation', 'content sanitization') for the untrusted-sources domain, matching the anchor that lists some actions but is not comprehensive rather than the multi-action level-3 anchor.	2 / 3
Completeness	Explicitly states what it does ('URL validation and content sanitization for untrusted sources') and when to use it ('use when handling external input safely'), satisfying the explicit-what-and-when level-3 anchor.	3 / 3
Trigger Term Quality	Terms like 'URL validation', 'content sanitization', 'untrusted sources', and 'external input' are relevant but lean technical and lack common natural-user variations, fitting the 'some relevant keywords but missing common variations' anchor.	2 / 3
Distinctiveness Conflict Risk	The untrusted-content niche is fairly specific, but 'content sanitization' and 'external input' overlap with other security/input-handling skills, so it could still trigger for a similar skill rather than being a clearly distinct niche.	2 / 3
	Total	9 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: nyldn/claude-octopus
Path: .claude/skills/skill-security-framing/SKILL.md
Commit: 9f39f0c

Reviewed: 11 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.