frontend-security-coder

Expert in secure frontend coding practices specializing in XSS prevention, output sanitization, and client-side security patterns. Use PROACTIVELY for frontend security implementations or client-side security code reviews.

Quality

63%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/frontend-security-coder/SKILL.md

Quality

Content

42%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body reads as an agent capability profile — an extensive catalog of what the agent knows with a high-level response sequence — rather than actionable skill guidance. It lacks executable examples and validation checkpoints, and inlines a large capability catalog that would benefit from reference files.

Suggestions

Replace descriptive capability lists with concrete, copy-paste-ready examples (e.g., a textContent-vs-innerHTML snippet, a sample CSP header, a DOMPurify sanitization call) so the skill instructs rather than describes.

Add validation/verification checkpoints inside the 'Response Approach' workflow (e.g., verify CSP with a violation-report check; confirm sanitization with a payload test) rather than only a final 'test' step.

Move the large Capabilities catalog into a reference file (e.g., references/capabilities.md) and keep SKILL.md as a lean overview that links to it, removing the redundant Knowledge Base and Behavioral Traits sections that restate Capabilities.

Dimension	Reasoning	Score
Conciseness	Mostly efficient bulleted lists, but the Knowledge Base section restates concepts Claude already knows ('XSS prevention techniques', 'Content Security Policy implementation') and Behavioral Traits largely duplicates Capabilities, so it could be tightened.	3 / 5
Actionability	The body almost entirely describes capabilities rather than instructing — there is no executable code, no commands, and the 'Response Approach' is only high-level hints ('Implement secure DOM manipulation using textContent and secure APIs') without concrete steps.	2 / 5
Workflow Clarity	The 'Response Approach' gives a 9-step sequence (assess → implement → configure → validate → test), but there are no validation checkpoints or feedback loops between steps, only a final testing step.	3 / 5
Progressive Disclosure	Headers provide structure, but at ~160 lines the large Capabilities catalog is inlined in SKILL.md with no bundle files or one-level-deep references to offload the detail, so content that should be separate stays inline.	3 / 5
	Total	11 / 20 Passed

Description

83%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is well-constructed: it states a clear niche, lists concrete capability areas, and provides an explicit PROACTIVE-use trigger covering both implementation and review scenarios. Its main weakness is missing common trigger synonyms (CSP, sanitization) and minor overlap with security-auditor.

Dimension	Reasoning	Score
Specificity	Names the domain plus several concrete areas — 'XSS prevention, output sanitization, and client-side security patterns' and 'frontend security implementations or client-side security code reviews' — but stops short of comprehensive coverage (e.g., CSP, DOM manipulation named only in the body).	4 / 5
Completeness	Explicitly answers both what ('Expert in secure frontend coding practices specializing in XSS prevention, output sanitization, and client-side security patterns') and when ('Use PROACTIVELY for frontend security implementations or client-side security code reviews') with concrete trigger phrases.	5 / 5
Trigger Term Quality	Includes natural user-facing terms like 'XSS prevention', 'frontend security', 'client-side security', and 'code reviews', but omits common synonyms a user might say such as 'Content Security Policy'/'CSP' or 'sanitizing input'.	4 / 5
Distinctiveness Conflict Risk	The frontend/client-side niche is fairly distinct, but 'client-side security code reviews' creates minor overlap with a general security-auditor skill, which the body itself has to disambiguate.	4 / 5
	Total	17 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: rmyndharis/antigravity-skills
Path: skills/frontend-security-coder/SKILL.md
Commit: 3eff4af

Reviewed: 1 day ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.