api-security-best-practices

Implement secure API design patterns including authentication, authorization, input validation, rate limiting, and protection against common API vulnerabilities

Quality

60%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/api-security-best-practices/SKILL.md

Quality

Content

50%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is strong on concrete, executable security patterns but is significantly over-long, explaining concepts Claude already knows and inlining everything into a single monolithic document. Trimming the conceptual 'Why' sections and OWASP definitions, and moving the large example blocks into reference files, would meaningfully raise both conciseness and progressive disclosure.

Suggestions

Cut concept-explanation padding Claude already knows: the 'Why Rate Limiting?' rationale, plain-language OWASP Top 10 definitions, and the duplicated Do/Don't lists — keep only the actionable security patterns.

Move the three large worked examples (JWT auth, input validation/SQL injection, rate limiting) into separate reference files (e.g. references/jwt-auth.md) and summarize them inline with one-level-deep links.

Turn the 'How It Works' steps into an explicit sequenced procedure with validation checkpoints (e.g. 'implement → run the security checklist → fix findings → re-test') to add the missing feedback loop.

Dimension	Reasoning	Score
Conciseness	At ~900 lines it is noticeably verbose, with several padded sections explaining concepts Claude already knows ('Why Rate Limiting?', OWASP API Top 10 plain-language definitions, repeated Do/Don't lists), matching the score-2 anchor of 'several unnecessary explanations or padded sections' rather than the leaner score-3.	2 / 5
Actionability	It provides mostly executable, concrete JavaScript (JWT sign/verify, parameterized queries, Zod validation, DOMPurify, express-rate-limit, Helmet) with imports, but some blocks reference undefined globals (`app`, `db`, `prisma`) without setup, leaving minor gaps that keep it just short of fully copy-paste-ready (5).	4 / 5
Workflow Clarity	'How It Works' lists five security dimensions as steps and includes a testing/checklist phase, but it is descriptive ('I'll help you implement...') rather than a strict sequenced procedure, and lacks explicit validate→fix→retry feedback loops, so checkpoints are implicit and the score caps at 3.	3 / 5
Progressive Disclosure	There is clear section structure with headers, but at ~900 lines it well exceeds the under-50-line simple-skill exception, and content that would benefit from separate files (three large code examples, full OWASP Top 10, long checklists) is entirely inlined with no bundle files present, matching the score-3 anchor of structured-but-should-be-split.	3 / 5
	Total	12 / 20 Passed

Description

71%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and lists comprehensive capabilities, but it omits any 'Use when...' trigger guidance, which caps completeness at 3 and slightly limits trigger-term and distinctiveness scores. Adding explicit use-when phrasing and a few concrete synonyms (JWT, OAuth, API security) would lift it toward a 5.

Suggestions

Append a 'Use when...' clause naming concrete triggers, e.g. 'Use when designing or securing REST/GraphQL/WebSocket APIs, or when the user mentions authentication, JWT/OAuth, rate limiting, or OWASP API Top 10.'

Add common synonyms and concrete terms (JWT, OAuth 2.0, API keys, API security, OWASP) to broaden natural keyword coverage.

Tighten the distinctiveness by scoping to API-specific security (e.g. 'REST, GraphQL, and WebSocket APIs') to reduce overlap with general backend/web security skills.

Dimension	Reasoning	Score
Specificity	The description lists multiple concrete actions — 'authentication, authorization, input validation, rate limiting, and protection against common API vulnerabilities' — giving comprehensive coverage of the API security domain, matching the score-5 anchor's 'multiple specific concrete actions'.	5 / 5
Completeness	It gives a clear 'what' (implement secure API design patterns including the listed capabilities) but no 'when'/trigger guidance at all; per the rubric, a missing 'Use when...' clause caps completeness at 3.	3 / 5
Trigger Term Quality	It includes natural terms a developer would say ('authentication', 'authorization', 'input validation', 'rate limiting', 'API vulnerabilities'), but is missing common synonyms and specifics like 'API keys', 'JWT', 'OAuth', 'API security', or 'OWASP', so it sits at good-but-not-comprehensive keyword coverage rather than 5.	4 / 5
Distinctiveness Conflict Risk	'Secure API design patterns' is a fairly distinct niche with clear triggers, but it overlaps with closely related security skills (the body itself cross-references sql-injection-testing, broken-authentication, etc.), giving minor overlap risk rather than the minimal risk of a 5.	4 / 5
	Total	16 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (916 lines); consider splitting into references/ and linking	Warning
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	14 / 16 Passed

Repository: sickn33/antigravity-awesome-skills
Path: skills/api-security-best-practices/SKILL.md
Commit: 1f67c44

Reviewed: about 15 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.