content-security-policy

Use when reviewing headers, forms, cookies, or third-party integrations related to Implement a content security policy. Validate the effective browser and HTTP behavior in a production-like environment.

Quality

70%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/content-security-policy/SKILL.md

Quality

Content

65%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is well-structured and concisely scoped as an overview that points to one real reference file, so progressive disclosure is strong. Actionability and workflow clarity are weaker because concrete code is deferred to the reference and the review process is presented as categories rather than a sequenced, checkpointed workflow.

Suggestions

Inline one minimal executable example (e.g. a strict CSP header string with nonce-based script-src) so the Fix section is copy-paste ready rather than abstract.

Turn the Check/Fix/Code Review sections into a short numbered sequence with an explicit validation checkpoint (e.g. 'Deploy, then verify the effective header via curl and check the browser console for CSP violations').

Trim the opening paragraph's restatement of what CSP prevents to just the non-obvious nuance about not replacing sanitization.

Dimension	Reasoning	Score
Conciseness	The body is lean with short Quick Reference bullets and compact Check/Fix/Explain/Code Review sections; the opening paragraph re-explains what CSP prevents (which Claude already knows), but it is brief and adds the sanitization nuance.	4 / 5
Actionability	Quick Reference gives concrete directives ('Start with Content-Security-Policy-Report-Only', 'Use nonces or hashes... instead of unsafe-inline', 'Set strict default-src then allow specific sources'), but no executable code examples are inline and the Fix section stays abstract ('Implement a strict Content Security Policy').	3 / 5
Workflow Clarity	The Check/Fix/Explain/Code Review sections read as aspects of a review rather than a sequenced workflow, and there are no explicit validation checkpoints; the 'verify them against the effective production-like response' hint is implicit rather than a checkpoint.	3 / 5
Progressive Disclosure	SKILL.md is a clear overview that defers full implementation details, code examples, and framework-specific guidance to a single one-level-deep, well-signaled reference (references/rule.md), which exists as a real file.	5 / 5
	Total	15 / 20 Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description has an explicit 'Use when' trigger and concrete review targets, giving it solid completeness and specificity. It reads slightly awkwardly because the rule title is embedded as a noun phrase, and a few natural synonyms (CSP, XSS) are missing.

Suggestions

Reword to state the capability directly in third person, e.g. 'Reviews Content Security Policy headers and directives...' before the 'Use when' clause, so the 'what' is explicit rather than implied.

Add common synonyms users say aloud — 'CSP' and 'XSS' — to broaden trigger term coverage.

Tighten the embedded 'related to Implement a content security policy' phrasing so the rule title does not appear mid-sentence as a noun phrase.

Dimension	Reasoning	Score
Specificity	Names several concrete review targets ('headers, forms, cookies, or third-party integrations', 'browser and HTTP behavior') with applied verbs (reviewing, validate), though the verbs themselves are somewhat generic.	4 / 5
Completeness	Explicitly provides the 'when' ('Use when reviewing headers, forms, cookies...') and an implied 'what' (review/validate CSP-related behavior), but the embedded phrase 'related to Implement a content security policy' makes the 'what' slightly less crisp.	4 / 5
Trigger Term Quality	Includes natural terms a user would say ('headers, forms, cookies, third-party integrations', 'content security policy', 'production-like environment'), but omits common synonyms like 'CSP' and 'XSS'.	4 / 5
Distinctiveness Conflict Risk	Anchored by 'content security policy' it carves a clear security niche, though 'headers, forms, cookies, third-party integrations' is broad enough to overlap with general web-security review skills.	4 / 5
	Total	16 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: thedaviddias/Front-End-Checklist
Path: skills/content-security-policy/SKILL.md
Commit: 30756a7

Reviewed: 15 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.