CtrlK
BlogDocsLog inGet started
Tessl Logo

referrer-policy

Use when reviewing HTTP response headers for privacy hardening on any website that handles authentication, session state, or sensitive URL parameters.

60

Quality

70%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/referrer-policy/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

72%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is a well-organized, actionable overview with excellent progressive disclosure to a single reference file, but the review workflow is presented as overlapping topical sections rather than a sequenced, checkpointed flow.

Suggestions

Collapse the redundant Check and Code Review sections into a single sequenced review flow with an explicit verify-against-production-response checkpoint.

Tighten the Code Review paragraph, which currently restates the task generically without adding concrete steps.

Add a short explicit 'verify the header value in the live response' step to make the validation loop explicit rather than implied.

DimensionReasoningScore

Conciseness

The body is mostly lean and assumes Claude's competence, but the Check and Code Review sections overlap and the Code Review paragraph reads as generic boilerplate that could be tightened.

2 / 3

Actionability

It gives the exact recommended value ('strict-origin-when-cross-origin'), explicitly flags 'unsafe-url' to avoid, and names concrete mechanisms (HTTP header, meta tag, referrerpolicy attribute), which is actionable guidance for an instruction-only skill.

3 / 3

Workflow Clarity

The Check/Fix/Explain/Code Review structure provides a topical review flow with a verification mention, but it is a checklist rather than a clearly sequenced workflow with explicit validation checkpoints, and Check/Code Review overlap.

2 / 3

Progressive Disclosure

The body is a concise overview that points to a well-signaled, one-level-deep reference ('see references/rule.md'), with implementation details appropriately split into that verified file.

3 / 3

Total

10

/

12

Passed

Description

67%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description has an explicit trigger and clear purpose, but is held back by omitting the natural Referrer-Policy/Referer keywords and by being a single action rather than multiple concrete capabilities.

Suggestions

Add the natural trigger terms users would say, e.g. 'Referrer-Policy', 'Referer header', or 'security headers'.

Name the specific header (Referrer-Policy) in the description to reduce overlap with general security-header skills.

Consider listing a second concrete action (e.g. 'verify' or 'configure') to lift specificity from one action to multiple.

DimensionReasoningScore

Specificity

It names the domain and one concrete action ('reviewing HTTP response headers for privacy hardening') but does not list multiple specific actions, matching the 'names domain and some actions, but not comprehensive' anchor.

2 / 3

Completeness

It has an explicit 'Use when...' trigger clause and states what the skill does (review HTTP response headers for privacy hardening), clearly answering both what and when.

3 / 3

Trigger Term Quality

It includes relevant keywords ('HTTP response headers', 'privacy hardening', 'authentication', 'session state', 'sensitive URL parameters') but omits the most natural user terms like 'Referrer-Policy', 'Referer', or 'security headers'.

2 / 3

Distinctiveness Conflict Risk

The privacy-hardening niche is somewhat specific, but because the specific header (Referrer-Policy) is never named it could overlap with broader security-header skills.

2 / 3

Total

9

/

12

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

Total

15

/

16

Passed

Repository
thedaviddias/Front-End-Checklist
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.