api-security-best-practices

Implement secure API design patterns including authentication, authorization, input validation, rate limiting, and protection against common API vulnerabilities

Quality

70%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/api-security-best-practices/SKILL.md

Quality

Content

75%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a well-structured, actionable API-security review guide with executable code and a validated worked example. It is concise for its depth and clearly navigable, though it lacks bundled reference files and a general fix-retry feedback loop.

Dimension	Reasoning	Score
Conciseness	The body is dense and information-rich, avoiding basic concept tutorials and focusing on nuanced guidance (HMAC JWT contracts, refresh-reuse handling, SSRF/DNS rebinding, store-outage behavior); a few framing sentences restate distinctions Claude already knows, keeping it just below 5.	4 / 5
Actionability	Provides concrete, executable code (verifyAccessToken, parsePositiveId, Zod validateBody, deleteOwnedPost) plus a worked example with specific test inputs ('12abc', an extra 'role' field) and expected outcomes; adapters are intentionally omitted, leaving minor gaps versus copy-paste completeness.	4 / 5
Workflow Clarity	The 'Worked example' section sequences a 5-step review with explicit validation checkpoints (expect 401 before storage, expect 400 and no mutation, expect denial for cross-tenant) and a 'remaining gaps' feedback step, but it is a test checklist rather than a fix-retry loop, so it sits at 4 rather than 5.	4 / 5
Progressive Disclosure	Well-organized into clearly headed sections (1-5, worked example, limitations, references) with an explicit References list and related-skills pointers; no bundle files exist to defer to, and the content is reasonably overview-level, so structure is good with only minor inline-bulk gaps.	4 / 5
	Total	16 / 20 Passed

Description

66%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description clearly communicates the skill's purpose and lists specific security domains, but it omits any explicit 'when to use' trigger clause, which limits completeness. It is otherwise specific and reasonably distinct.

Suggestions

Add an explicit 'Use when...' clause naming concrete triggers, e.g. 'Use when adding a protected endpoint, reviewing object-level authorization, or hardening an API against common vulnerabilities.'

Include natural user phrasings as triggers (e.g. 'secure my API', 'API auth review', 'rate limiting') to improve trigger-term coverage.

Tighten 'protection against common API vulnerabilities' into a concrete action (e.g. 'guard against OWASP API Top-10 issues') to lift specificity toward 5.

Dimension	Reasoning	Score
Specificity	Lists several specific security domains — 'authentication, authorization, input validation, rate limiting, and protection against common API vulnerabilities' — giving concrete coverage, though the final clause ('protection against common API vulnerabilities') is somewhat generic rather than a concrete action.	4 / 5
Completeness	Has a clear 'what' ('Implement secure API design patterns including...') but no 'Use when...' clause or equivalent explicit trigger guidance, which caps completeness at 3 per the judging guidelines.	3 / 5
Trigger Term Quality	Includes natural developer-facing terms ('authentication', 'authorization', 'input validation', 'rate limiting', 'API vulnerabilities') a user would plausibly say, but lacks synonyms/variations and has no file-extension-style triggers.	4 / 5
Distinctiveness Conflict Risk	Targets a clear API-security niche that is mostly distinct, with only minor overlap risk against closely related skills such as auth-implementation-patterns (which the body itself lists as related).	4 / 5
	Total	15 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: sickn33/agentic-awesome-skills
Path: skills/api-security-best-practices/SKILL.md
Commit: b1aebac

Reviewed: ~17 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.