Content
72%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The body is concise and well-structured as a review skill, with a clean single-reference pointer to a detailed, executable rule.md. Its weaknesses are the lack of inline executable code and the absence of explicit validation checkpoints in the body itself, both of which are deferred to the reference.
Suggestions
Include one short inline code snippet (e.g. an ALLOWED_ORIGINS postMessage guard) so the body is actionable without opening the reference.
Surface the verification checklist (especially the malicious-redirect test) directly in the body so review workflows have an explicit validation checkpoint.
Collapse the partially overlapping Check/Fix/Explain/Code Review sections to reduce redundancy with Quick Reference.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is lean — terse Quick Reference bullets and short imperative sections — with no padding explaining what SOP or CORS fundamentally are; every section earns its place. | 3 / 3 |
Actionability | Guidance names concrete items ('verify event.origin', 'Never set Access-Control-Allow-Origin: *', reject 'next', 'redirect', or 'callbackUrl'), but the body contains no executable code; copy-paste examples live only in the referenced file. | 2 / 3 |
Workflow Clarity | Sections (Check, Fix, Explain, Code Review) are labeled tasks rather than a sequenced multi-step process, and the body has no explicit validation checkpoints; the verification checklist lives in the reference instead. | 2 / 3 |
Progressive Disclosure | The body is a concise overview that signals a single one-level-deep reference ('see references/rule.md'), which exists and is well-organized, making navigation easy. | 3 / 3 |
Total | 10 / 12 Passed |