session-cookie-flags

Use when reviewing server-side session management, setting up authentication middleware, or auditing cookie configuration in HTTP response headers.

Quality

76%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/session-cookie-flags/SKILL.md

Quality

Content

65%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured overview that practices good progressive disclosure by delegating code and verification to references/rule.md. The trade-off is reduced actionability and workflow clarity in the body itself, where execution details and validation checkpoints live only in the reference.

Suggestions

Add one concrete executable check to the body (e.g., a one-line `curl -I ... | grep -i set-cookie` example) so the overview is actionable without opening the reference.

Tighten the redundancy between the intro paragraph and the Quick Reference bullets so each flag's rationale is stated once.

Surface a brief verification checkpoint in the body (e.g., "confirm Set-Cookie shows HttpOnly; Secure; SameSite=Strict") to make the workflow sequence explicit before delegating full checks to rule.md.

Dimension	Reasoning	Score
Conciseness	The body is compact and mostly earns its tokens, but the intro paragraph and the Quick Reference bullets both re-explain what each flag prevents — a minor redundancy that could be trimmed without losing clarity.	4 / 5
Actionability	The Check/Fix/Code Review sections give concrete review criteria (flag missing HttpOnly, absent Secure, permissive SameSite) but no executable commands or code in the body itself — the actual curl/framework snippets live in references/rule.md, leaving key execution details out of the overview.	3 / 5
Workflow Clarity	The Check/Fix/Explain/Code Review sections read as parallel engagement modes rather than a sequenced workflow, and no explicit validation/verification checkpoint is present in the body (verification is delegated to rule.md), leaving sequence and checkpoints implicit.	3 / 5
Progressive Disclosure	The body is a lean overview that keeps bulk implementation in a single, clearly signaled one-level-deep reference (references/rule.md, verified to exist), with well-organized sections and easy navigation.	5 / 5
	Total	15 / 20 Passed

Description

87%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A concise, well-targeted description that clearly states capabilities and explicit trigger conditions with low conflict risk. Slight headroom remains on action specificity and synonym coverage.

Dimension	Reasoning	Score
Specificity	Lists several concrete actions — "reviewing server-side session management", "setting up authentication middleware", "auditing cookie configuration in HTTP response headers" — but stops at three high-level actions rather than enumerating the full set of sub-tasks, leaving minor coverage gaps.	4 / 5
Completeness	Explicitly answers both what (review/set up/audit cookie-related security) and when ("Use when reviewing... setting up... or auditing...") with concrete trigger phrases, matching the top anchor.	5 / 5
Trigger Term Quality	Includes natural phrases users would say ("session management", "authentication middleware", "cookie configuration", "HTTP response headers") but omits common synonyms and specifics like "session cookies", "Secure/HttpOnly flags", or "CSRF".	4 / 5
Distinctiveness Conflict Risk	Targets a clear security niche (session cookie flags / auth middleware) with distinct triggers and minimal overlap risk against unrelated skills.	5 / 5
	Total	18 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: thedaviddias/Front-End-Checklist
Path: skills/session-cookie-flags/SKILL.md
Commit: 30756a7

Reviewed: 13 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.