frontend-mobile-security-xss-scan

You are a frontend security specialist focusing on Cross-Site Scripting (XSS) vulnerability detection and prevention. Analyze React, Vue, Angular, and vanilla JavaScript code to identify injection poi

Quality

61%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/frontend-mobile-security-xss-scan/SKILL.md

Quality

Content

65%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with executable code and commands, but it is monolithic with no external references and its scanning workflow lacks explicit validation checkpoints for batch operations.

Suggestions

Add a verification/validation step to the scanning workflow, e.g., triage findings to remove false positives before report generation, to lift workflow clarity above 2.

Move the framework-specific scanners (React/Vue/Angular) and the report generator into separate reference files referenced from SKILL.md to improve progressive disclosure.

Trim the full class scaffolding down to the essential detection patterns and fixes so the body stays lean and avoids over-implementation.

Dimension	Reasoning	Score
Conciseness	The body is mostly token-efficient executable code rather than prose, but it embeds full class implementations (XSSScanner, ReactXSSScanner, VueXSSScanner, SecureCodingGuide, XSSReportGenerator) that go beyond guidance Claude could derive, fitting the "mostly efficient but includes some unnecessary elaboration" anchor.	2 / 3
Actionability	Provides fully executable TypeScript scanner code, concrete bash commands ("npm install --save-dev eslint-plugin-security", "semgrep --config=p/xss"), and copy-paste secure-coding examples, matching the "fully executable code/commands; copy-paste ready" anchor.	3 / 3
Workflow Clarity	Six numbered sections sequence detection through reporting, but the batch scanning workflow lacks explicit validation/verification checkpoints (e.g., confirm findings before reporting); per guideline missing validation for batch operations caps workflow clarity at 2.	2 / 3
Progressive Disclosure	No bundle files exist and the content is a single monolithic file with content (framework scanners, report generator) that could be split into separate references; sectioning is reasonable but nothing is externalized, matching the "some structure but content that should be separate is inline" anchor.	2 / 3
	Total	9 / 12 Passed

Description

57%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description names a clear, distinctive niche and several concrete actions, but uses second-person voice, is truncated mid-sentence, and lacks an explicit "Use when..." trigger clause.

Suggestions

Rewrite in third person (e.g., "Scans React, Vue, Angular, and vanilla JavaScript code for XSS vulnerabilities") and remove the "You are..." framing to avoid the specificity penalty.

Add an explicit trigger clause such as "Use when reviewing frontend code for Cross-Site Scripting (XSS) risks or when the user mentions injection, unsafe HTML rendering, or DOM sanitization."

Fix the truncation so the description is complete (the sentence ends mid-word at "injection poi").

Dimension	Reasoning	Score
Specificity	Names concrete actions ("identify injection points, unsafe DOM manipulation, and improper sanitization") across React/Vue/Angular/vanilla JS, matching the multiple-actions anchor, but uses second person ("You are a frontend security specialist") which per guideline reduces specificity by 1, and the description is truncated mid-word ("injection poi").	2 / 3
Completeness	Answers "what" (detect XSS, analyze frameworks) but has no explicit "Use when..." trigger clause; per guideline a missing trigger clause caps completeness at 2, and truncation further weakens the what.	2 / 3
Trigger Term Quality	Includes relevant keywords ("XSS", "React, Vue, Angular", "JavaScript") but mixes in technical jargon ("injection points, unsafe DOM manipulation") and lacks common natural trigger phrasing, fitting the "some relevant keywords but missing common variations" anchor.	2 / 3
Distinctiveness Conflict Risk	"frontend security specialist focusing on Cross-Site Scripting (XSS)" defines a clear niche with framework-specific triggers, making it unlikely to fire for unrelated skills.	3 / 3
	Total	9 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: rmyndharis/antigravity-skills
Path: skills/frontend-mobile-security-xss-scan/SKILL.md
Commit: e63f7dd

Reviewed: 13 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.