cross-origin-isolation

Use when reviewing security-sensitive web apps, SharedArrayBuffer usage, worker-heavy apps, editors, or measurement features that require cross-origin isolation. Check both headers and real browser behavior.

Quality

76%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/cross-origin-isolation/SKILL.md

Quality

Content

71%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-organized, concise overview that points cleanly to a real reference file and includes a concrete verification checkpoint. The main weakness is actionability: the most executable material (headers and code) lives in the reference rather than inline, so the body stays at a high level.

Suggestions

Add a short inline header block (e.g. the Cross-Origin-Opener-Policy / Cross-Origin-Embedder-Policy values) so the body is actionable without opening the reference.

Include the `if (!self.crossOriginIsolated) { ... }` verification snippet inline in the Fix section to make the validation checkpoint copy-paste ready.

Tighten the opening paragraph and the trailing "Explain/Code Review" sections to drop redundant framing already covered by the reference.

Dimension	Reasoning	Score
Conciseness	The body is lean with short, focused sections that assume competence; only the opening paragraph and the trailing "Explain/Code Review" framing add a little explanatory padding that could be trimmed.	4 / 5
Actionability	Guidance is concrete (audit scripts/iframes/workers, serve resources with CORP/CORS, verify crossOriginIsolated), but executable header/code examples are deferred to references rather than shown inline, leaving gaps.	3 / 5
Workflow Clarity	A clear Check → Fix → verify sequence is present with an explicit validation checkpoint ("Verify self.crossOriginIsolated === true"), though error-recovery feedback loops are only implied.	4 / 5
Progressive Disclosure	The SKILL.md is a concise overview with a single, clearly signaled one-level-deep reference (references/rule.md) that exists in the bundle, giving easy navigation.	5 / 5
	Total	16 / 20 Passed

Description

82%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, well-structured description with explicit what-and-when guidance and natural trigger terms tied to a distinct security niche. The only gap is moderate specificity, since the actions ("check headers", "check browser behavior") are stated at a high level rather than enumerated.

Dimension	Reasoning	Score
Specificity	The description names the cross-origin isolation domain and two concrete actions ("Check both headers" and "real browser behavior"), but stops short of comprehensive coverage of the actions involved.	3 / 5
Completeness	It explicitly answers what to do (check headers and real browser behavior for cross-origin isolation) and when to use it ("Use when reviewing security-sensitive web apps, SharedArrayBuffer usage...") with concrete trigger phrases.	5 / 5
Trigger Term Quality	Natural trigger phrases like "security-sensitive web apps", "SharedArrayBuffer usage", "worker-heavy apps", "editors", and "measurement features" match what users would say, though a few synonyms (e.g. COOP/COEP) are absent.	4 / 5
Distinctiveness Conflict Risk	It targets a clear niche (cross-origin isolation for SharedArrayBuffer/worker-heavy apps) with distinct triggers, so it is unlikely to fire for unrelated skills.	5 / 5
	Total	17 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: thedaviddias/Front-End-Checklist
Path: skills/cross-origin-isolation/SKILL.md
Commit: 30756a7

Reviewed: 9 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.