content-security-policy

Use when reviewing headers, forms, cookies, or third-party integrations related to Implement a content security policy. Validate the effective browser and HTTP behavior in a production-like environment.

Quality

73%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/content-security-policy/SKILL.md

Quality

Content

70%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is concise and well-structured with appropriate progressive disclosure to a real reference file. It is held back by the absence of executable code/commands and missing explicit validation checkpoints in the workflow.

Suggestions

Add at least one copy-paste-ready CSP header example or a curl command to inspect headers in the body, so the core action is executable without opening the reference.

Insert an explicit validation checkpoint in the workflow, e.g. 'Verify the effective header with curl -I or browser DevTools before declaring the rule satisfied.'

Add a brief fix->verify->retry loop note since CSP/Trusted Types changes can break a live site and warrant a re-check step.

Dimension	Reasoning	Score
Conciseness	The body is lean — a short intro, a Quick Reference bullet list, and terse Check/Fix/Explain/Code Review sections — with no padding or explanation of concepts Claude already knows, so every token earns its place.	3 / 3
Actionability	Guidance is concrete in direction (e.g. 'Set strict default-src then allow specific sources', 'Use nonces or hashes for inline scripts') but contains no executable code, commands, or copy-paste examples in the body itself — those are deferred to the reference, matching the incomplete-but-actionable score-2 anchor.	2 / 3
Workflow Clarity	The Check/Fix/Explain/Code Review sections give a recognizable sequence, but there are no explicit validation checkpoints for verifying the effective production-like response, and the body itself says to 'verify them against the effective production-like response' without a concrete feedback loop.	2 / 3
Progressive Disclosure	The body is a concise overview with well-organized sections and a single, clearly signaled one-level-deep pointer to the real references/rule.md file (which exists), matching the clear-overview-with-one-level-references anchor.	3 / 3
	Total	10 / 12 Passed

Description

77%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, complete, and distinctive, with an explicit 'Use when' trigger. Its main weakness is that the embedded phrase 'Implement a content security policy' reads as a task title rather than natural user wording, slightly weakening trigger-term quality.

Suggestions

Reframe the embedded task title into natural user phrasing, e.g. 'Use when the user asks about CSP, Content-Security-Policy headers, or securing forms/cookies against XSS.'

Add the common shorthand 'CSP' as an explicit trigger term since users frequently say it.

Dimension	Reasoning	Score
Specificity	It lists concrete review actions — 'reviewing headers, forms, cookies, or third-party integrations' and 'Validate the effective browser and HTTP behavior in a production-like environment' — which are multiple specific actions, matching the score-3 anchor.	3 / 3
Completeness	It explicitly answers 'when' with 'Use when reviewing headers, forms, cookies...' and 'what' by tying those actions to implementing a content security policy and validating browser/HTTP behavior, satisfying both halves with an explicit 'Use when...' clause.	3 / 3
Trigger Term Quality	Natural terms like 'headers', 'forms', 'cookies', and 'third-party integrations' are present, but the core phrase 'Implement a content security policy' is a task title rather than wording a user would naturally say, and common triggers like 'CSP' or 'content security policy' as a user utterance are not framed as natural keywords.	2 / 3
Distinctiveness Conflict Risk	The CSP/security-header niche with headers, cookies, and third-party integration triggers is distinct and unlikely to overlap with unrelated skills; the rule link and metadata further anchor it to a specific checklist rule.	3 / 3
	Total	11 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: thedaviddias/Front-End-Checklist
Path: skills/content-security-policy/SKILL.md
Commit: 48405aa

Reviewed: about 8 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.