CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

defense-in-depth-validation

Validate at every layer data passes through to make bugs impossible. Use when invalid data causes failures deep in execution, requiring validation at multiple system layers.

57

Quality

72%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./plugins/defense-in-depth-validation/skills/defense-in-depth-validation/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

67%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body delivers concrete, executable code for all four validation layers plus a clear application workflow with a test step. Its weaknesses are repetition of the core principle across three motivational sections and a session-specific example that pads the token budget without adding generalizable guidance.

Suggestions

Collapse 'Why Multiple Layers', 'Key Insight', and 'Example from Session' into a short rationale and one condensed worked example; drop session-specific details like the 1847-test count.

Make layer snippets more copy-paste ready by including imports and defining helpers (normalize, tmpdir, verifySession) or explicitly noting they are illustrative fragments.

Add a feedback loop to the workflow: what to do when a layer fails or a bypass test succeeds (fix the layer, re-run the bypass test) — and consider moving the security defense-in-depth section to a reference file.

DimensionReasoningScore

Conciseness

The four layers and code examples are lean, but sections like 'Why Multiple Layers' (the sloganistic fixed-the-bug/made-the-bug-impossible contrast), 'Example from Session' ('All 1847 tests passed', session-specific narrative), and 'Key Insight' largely restate the core principle already stated in the Overview. This matches anchor 3 (mostly efficient with some unnecessary explanation that could be tightened) rather than anchor 4, where only minor instances would remain.

3 / 5

Actionability

Each layer has concrete TypeScript code with specific checks (empty/exists/isDirectory guards, NODE_ENV tmp-dir guard, debug logging with stack), and 'Applying the Pattern' gives four executable steps. Minor gaps keep it below anchor 5: snippets are illustrative rather than copy-paste complete ('// ... proceed', undefined helpers like normalize/tmpdir/verifySession) and imports are omitted.

4 / 5

Workflow Clarity

'Applying the Pattern' lays out a clear 4-step sequence (trace data flow, map checkpoints, add validation per layer, test each layer) that includes an explicit validation step ('Try to bypass layer 1, verify layer 2 catches it'). It falls short of anchor 5 because there is no feedback loop for what to do when a layer fails or a fix-and-retry cycle, and no checklist for complex flows.

4 / 5

Progressive Disclosure

The body is a single self-contained file with no bundle files (references/, scripts/, assets/ are absent) and no external references to verify, so there are no buried or nested references. Sections are well-organized and easy to navigate, but the appended ~30-line security defense-in-depth section is a distinct topic that could live in a separate reference file, leaving anchor 4 (good structure, minor organization gaps) as the best fit.

4 / 5

Total

15

/

20

Passed

Description

62%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A solid description with an explicit what and a 'Use when' clause, written in third person. It is held back by thin trigger-term coverage and a single-verb capability statement rather than a list of concrete actions.

Suggestions

Add natural trigger phrases users would actually say, e.g. 'Use when the user reports a bug from bad input, asks to validate inputs, harden against invalid data, or mentions defense in depth'.

Enumerate the concrete actions the skill performs (trace the data flow, add entry/business/environment-layer checks, add debug instrumentation, test that each layer catches bypasses).

Distinguish the skill from plain input validation by naming the pattern explicitly ('defense-in-depth validation') in the description.

DimensionReasoningScore

Specificity

The description names the domain ('validation at multiple system layers') and one concrete action ('Validate at every layer data passes through'), but does not enumerate multiple specific actions. It matches anchor 3 (domain plus 1-2 concrete actions, not comprehensive) rather than anchor 4, which expects several listed specific actions.

3 / 5

Completeness

Both parts are present: what ('Validate at every layer data passes through to make bugs impossible') and when ('Use when invalid data causes failures deep in execution...'). It is below anchor 5 because the trigger clause lacks concrete trigger phrases a user would naturally say, and 'requiring validation at multiple system layers' restates the what rather than sharpening the when. The explicit 'Use when' clause keeps it above anchor 3.

4 / 5

Trigger Term Quality

Phrases like 'invalid data causes failures deep in execution' are somewhat natural, but coverage is thin: no synonyms or common variations (e.g., 'bad input', 'sanitize input', 'input validation', 'guard clauses'). Anchor 3 (some relevant keywords, missing common variations) is the best fit; not anchor 4 because keyword coverage is not 'good'.

3 / 5

Distinctiveness Conflict Risk

The multi-layer validation framing carves a fairly distinct niche and is unlikely to trigger for unrelated skills, though it overlaps with generic input-validation, debugging, and security-hardening skills. Anchor 4 (mostly distinct, minor overlap risk with closely related skills) fits better than anchor 5.

4 / 5

Total

14

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

secondsky/claude-skills

Path

plugins/defense-in-depth-validation/skills/defense-in-depth-validation/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.