form-captcha

Use when reviewing public HTML forms (no authentication required to reach them) for bot and abuse protection mechanisms.

Quality

58%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/form-captcha/SKILL.md

Quality

Content

67%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is well-structured, concise, and uses progressive disclosure effectively by offloading detail to references/rule.md. Its main weakness is actionability: the body stays at the directive level without inline code or concrete specifics, leaning on the reference for executable guidance.

Suggestions

Add one small inline code snippet (e.g. a server-side Turnstile/reCAPTCHA token verification call) so the body is executable without forcing a jump to the reference.

Make the Check section's verification step explicit as a checkpoint (e.g. "Confirm tokens are validated server-side; client-side checks are bypassable") rather than leaving it implied.

Tighten the opening attack-consequence paragraph to one line to free tokens for actionable detail.

Dimension	Reasoning	Score
Conciseness	The body is lean with well-organized Quick Reference / Check / Fix / Explain / Code Review sections and avoids explaining concepts Claude already knows; the only mild excess is the opening paragraph on attack consequences, which is light context rather than padding.	4 / 5
Actionability	Guidance is directional and actionable at a high level ("Integrate a CAPTCHA service... Validate the CAPTCHA response token on your server") but offers no inline code, headers, or specifics in the body itself, deferring concrete examples to the reference file, matching the anchor of some-but-incomplete concrete guidance.	3 / 5
Workflow Clarity	Check / Fix / Explain / Code Review sequence the work clearly, and the Code Review section names a verification checkpoint ("verify them against the effective production-like response"), with only minor implicit checkpoints, fitting the clear-sequence-most-checkpoints anchor.	4 / 5
Progressive Disclosure	The body is a concise overview that defers implementation detail to a clearly signaled, one-level-deep reference (references/rule.md, verified present), with good section structure; only minor organization gaps keep it just below a 5.	4 / 5
	Total	15 / 20 Passed

Description

48%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description has a clear, well-scoped trigger ("Use when reviewing public HTML forms...") but its capability statement is vague and lacks concrete actions or the natural keyword "CAPTCHA." It is mostly distinct from sibling skills yet undersells what the skill actually does.

Suggestions

Lead with concrete verbs, e.g. "Identifies, reviews, and guides integration of CAPTCHA / bot protection on public HTML forms."

Add the natural keyword "CAPTCHA" and related terms (spam, credential stuffing, honeypot, rate limiting) so users trigger the skill with the words they actually say.

Tighten the "what" to a clear capability statement rather than "reviewing... for bot and abuse protection mechanisms."

Dimension	Reasoning	Score
Specificity	The description names the domain ("public HTML forms") but the only action is the generic "reviewing," with no concrete verbs like identify, validate, integrate, or audit; matching the anchor that names the domain but offers minimal/generic actions.	2 / 5
Completeness	It has an explicit "Use when..." trigger, but the "what" is only weakly stated as "reviewing... for bot and abuse protection mechanisms," which is vague rather than a clear statement of capability, fitting the anchor with a clear when but a weak/implied what.	3 / 5
Trigger Term Quality	It includes the natural phrase "public HTML forms" and "bot and abuse protection," but omits common user terms and synonyms such as CAPTCHA, spam, credential stuffing, or honeypot, so coverage is only partial.	3 / 5
Distinctiveness Conflict Risk	The niche (unauthenticated public HTML forms, bot/abuse protection) is fairly distinct and unlikely to misfire, with only minor overlap risk against neighboring security review skills, matching the mostly-distinct anchor.	4 / 5
	Total	12 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: thedaviddias/Front-End-Checklist
Path: skills/form-captcha/SKILL.md
Commit: 30756a7

Reviewed: 13 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.