content-security-policy

Use when reviewing headers, forms, cookies, or third-party integrations related to Implement a content security policy. Validate the effective browser and HTTP behavior in a production-like environment.

Quality

57%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/content-security-policy/SKILL.md

Quality

Content

57%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a well-structured overview with exemplary progressive disclosure, pushing detailed implementation to a real one-level-deep reference. Its weaknesses are the absence of any executable commands or snippets in the body itself, an implicit rather than explicit verification checkpoint, and mild redundancy plus Claude-known background explanation.

Suggestions

Add one concrete inspection step to the Check section (e.g., a curl command to fetch and view the Content-Security-Policy header) so the body is actionable without opening the reference.

Make the Code Review verification an explicit checkpoint — state how to reproduce and confirm a flagged violation (fetch the production-like response, re-check after the fix) instead of only 'verify them against the effective production-like response'.

Trim the Claude-known intro paragraph ('Content Security Policy prevents cross-site scripting (XSS), clickjacking...') and consolidate the sanitize-untrusted-HTML point, which currently appears in four sections.

Dimension	Reasoning	Score
Conciseness	The body is mostly lean, but the intro explains what CSP prevents (knowledge Claude already has) and the sanitize-untrusted-HTML point is repeated across Quick Reference, Fix, Explain, and Code Review, fitting the mostly-efficient-but-could-be-tightened anchor.	3 / 5
Actionability	Quick Reference gives concrete principles ('Start with Content-Security-Policy-Report-Only', 'Use nonces or hashes for inline scripts'), but the body contains no executable commands or snippets (e.g., how to fetch and inspect the header) and defers all code to the reference file, matching the some-concrete-guidance-but-incomplete anchor.	3 / 5
Workflow Clarity	Check → Fix → Explain is thematic rather than a sequenced workflow; the 'verify them against the effective production-like response' checkpoint is implicit and there is no explicit validate-and-retry loop, matching the sequence-present-but-checkpoints-implicit anchor.	3 / 5
Progressive Disclosure	A ~49-line overview body with well-organized sections plus a clearly signaled one-level-deep pointer ('For full implementation details, code examples, and framework-specific guidance, see references/rule.md') to a verified 369-line detail file — textbook appropriate content splitting.	5 / 5
	Total	14 / 20 Passed

Description

57%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description has a working explicit trigger clause and reasonable domain keywords, but its capability statement is abstract and it omits the most natural synonyms (CSP, XSS). It is serviceable yet clearly below the strong examples in concreteness and precision.

Suggestions

State a concrete capability instead of the abstract 'Validate the effective browser and HTTP behavior' — e.g., 'Audits Content-Security-Policy headers, flags risky directives like unsafe-inline, and verifies the effective policy in a production-like environment.'

Add the abbreviations users actually say — 'CSP' and 'XSS' — as trigger terms alongside the spelled-out forms.

Drop or narrow the generic 'forms, cookies' triggers (or tie them explicitly to CSP, e.g. 'form-action and cookie-related CSP directives') to reduce conflict with form-validation and cookie-handling skills.

Dimension	Reasoning	Score
Specificity	The description names the domain (headers, forms, cookies, third-party integrations, content security policy) but offers only abstract actions like 'Validate the effective browser and HTTP behavior in a production-like environment' rather than several concrete capabilities, matching the domain-plus-1-2-actions anchor.	3 / 5
Completeness	An explicit 'Use when...' clause is present, but the 'what' is vague ('Validate the effective browser and HTTP behavior in a production-like environment') and the fragment 'related to Implement a content security policy' reads as a template artifact, leaving it between the clear-what and both-present anchors.	3 / 5
Trigger Term Quality	Natural trigger terms are present ('headers', 'forms', 'cookies', 'third-party integrations', 'content security policy') but the most common synonyms users would say — 'CSP' and 'XSS' — are missing, fitting the good-coverage-with-a-few-missing anchor.	4 / 5
Distinctiveness Conflict Risk	'forms' and 'cookies' would also naturally trigger form-validation and cookie-handling skills; the CSP qualifier narrows the scope but overlap with sibling security-checklist skills remains, matching the somewhat-specific-but-still-overlapping anchor.	3 / 5
	Total	13 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: thedaviddias/Front-End-Checklist
Path: skills/content-security-policy/SKILL.md
Commit: 7bfd868

Reviewed: 1 day ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.