Content
42%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The body delivers genuinely useful material (detection patterns, secure alternatives, framework-specific guidance) but buries it in a verbose, mostly-non-executable inline scanner class with no bundle files and no validation steps in its workflow. It reads as a code dump plus boilerplate rather than a lean, well-structured skill.
Suggestions
Move the XSSScanner implementation into a scripts/ file (and the secure-pattern catalog and prevention checklist into references/), keeping SKILL.md as a lean overview that links to them one level deep.
Trim the 'Context', 'Use this skill when', and 'Do not use this skill when' filler sections and remove the unfilled '$ARGUMENTS' placeholder — they restate the skill name without adding guidance.
Add explicit validation checkpoints to the workflow, e.g. confirm flagged lines truly reach an unsanitized sink (vs. framework auto-escaping) before reporting, and re-scan to verify applied fixes; also make the inline code complete (import fs, define findJavaScriptFiles and detectEventHandlerIssues) or explicitly label it as illustrative.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The ~320-line body is dominated by a generic TypeScript scanner implementation that spells out XSS knowledge Claude already has, plus padded boilerplate ('Context', 'Use this skill when / Do not use' sections that merely echo the skill name) and an unfilled '$ARGUMENTS' placeholder. Several unnecessary sections put it at anchor 2; it is not 1 because the material is not concept-explanation filler throughout. | 2 / 5 |
Actionability | The secure-coding examples and ESLint/Semgrep commands are concrete, but the central scanner code has real gaps: 'fs' is never imported, 'findJavaScriptFiles()' and 'detectEventHandlerIssues()' are called but never defined, and the React/Vue scanner findings omit required XSSFinding fields. This is incomplete rather than fully executable, matching anchor 3. | 3 / 5 |
Workflow Clarity | The six numbered sections form a rough scan-to-report sequence, but there are no validation checkpoints (e.g., verify findings against framework auto-escaping before flagging, or confirm a fix removes the sink). Because scanning a whole codebase is a batch operation, the rubric caps workflow clarity at 3. | 3 / 5 |
Progressive Disclosure | Section headers give the single-file body some structure and navigation, but with no references/, scripts/, or assets/ files at all, ~150 lines of scanner implementation and the checklists are inlined where they clearly belong in separate bundle files. This sits between anchors 2 and 3; the present section organization keeps it at 3. | 3 / 5 |
Total | 11 / 20 Passed |