Content
53%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The content contains genuinely valuable payment-domain expertise (webhook security, idempotency, PCI essentials) but is undercut by boilerplate sections, a total absence of executable code despite demanding code outputs, and a principle-style "Approach" list instead of a validated workflow. Structure and organization are the strongest aspect.
Suggestions
Delete the generic "Use this skill when", "Do not use this skill when", and "Instructions" sections — they are template filler that dilutes the payment-specific content and costs tokens.
Replace abstract directives with executable anchors: a minimal verified Stripe webhook handler showing raw-body signature verification and a 2xx-before-processing pattern, since the skill itself demands "Webhook endpoint implementations" as output.
Restructure "Approach" into a sequenced implementation workflow with explicit validation checkpoints (e.g., test-mode transaction verified → webhook signature test passes → then migrate keys), mirroring the validate-before-proceed pattern.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The domain content ("Signature Verification", "Raw Body Preservation", "Environment Separation") is dense and valuable, but the "Use this skill when", "Do not use this skill when", and "Instructions" sections are generic boilerplate ("Clarify goals, constraints, and required inputs. Apply relevant best practices and validate outcomes.") that adds no payment-specific signal and could be cut. | 3 / 5 |
Actionability | Guidance is directionally concrete ("Return `2xx` status within 200ms", "Store event IDs in your database", "Use tokenization APIs (Stripe Elements, PayPal SDK)") but contains no executable code, commands, or examples — the "Output" section only names deliverables like "Webhook endpoint implementations" without showing any. It sits between "high-level hints" (2) and "concrete code with minor gaps" (4). | 3 / 5 |
Workflow Clarity | The "Approach" list ("1. Security first", "2. Implement idempotency", "4. Test mode first") reads as principles rather than a sequenced process with checkpoints; validation guidance exists scattered ("Re-fetch payment status from provider API") but there is no explicit validate-then-proceed flow for the risky operations it describes. | 3 / 5 |
Progressive Disclosure | The body is well-sectioned with clear headers ("Critical Requirements", "Common Failures", "Output") and references no external files — none are needed and the bundle contains none, so it avoids nested or buried references. It falls short of a 5 only because ~68 lines of detailed material (webhook security, PCI essentials) sits fully inline where a one-level-deep split could keep SKILL.md leaner. | 4 / 5 |
Total | 13 / 20 Passed |