stack-trace-exposure

Use when reviewing error handling middleware, API route handlers, or server responses for security-sensitive information disclosure.

Quality

67%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/stack-trace-exposure/SKILL.md

Quality

Content

65%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is a well-structured overview with excellent progressive disclosure pointing to one real reference file, but its actionability and workflow clarity are held back by the absence of executable examples and explicit validation checkpoints in the body.

Suggestions

Add at least one small inline code snippet showing a sanitized central error handler so the body is actionable without opening the reference.

Insert an explicit validation step after Fix (e.g., "Verify production responses return only the generic message and no stack trace or internal path").

Trim the opening paragraph's attacker-CVE and OWASP A09 background, which restates knowledge Claude already has.

Dimension	Reasoning	Score
Conciseness	The body is mostly lean with tight Quick Reference bullets and one-line Check/Fix/Explain/Code Review sections; the only trimming candidate is the opening paragraph, which explains attacker CVE-lookup behavior and OWASP A09 that Claude already knows.	4 / 5
Actionability	The Quick Reference gives concrete directives ("Never return raw error objects", "Log full details server-side; send only a generic message") and Code Review names specific patterns to flag (error.stack, raw error.message, internal paths), but the body contains no executable code and defers all implementation to the reference file.	3 / 5
Workflow Clarity	The Check → Fix → Code Review sections give a rough review sequence, but there is no explicit validation checkpoint (e.g., verify no stack traces leak after fixing) and the steps are implicit rather than enumerated.	3 / 5
Progressive Disclosure	The body is a concise overview with well-organized sections and a single clearly signaled one-level-deep reference ("see references/rule.md"), which exists as a real bundle file, making navigation easy.	5 / 5
	Total	15 / 20 Passed

Description

70%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is well-targeted with a clear trigger clause and distinct security niche, though it leans on a single action verb and slightly conflates the what and when. Keyword coverage is strong but lacks synonyms.

Suggestions

Add a second concrete action verb (e.g., "sanitize" or "remediate") so the capability reads as more than a single reviewing action.

Separate the what from the when: state the outcome first ("Sanitize error responses to prevent stack trace and internal-detail disclosure"), then the "Use when..." trigger.

Include natural synonyms users might say, such as "stack traces", "error leakage", or "internal details".

Dimension	Reasoning	Score
Specificity	The description names several concrete review targets ("error handling middleware, API route handlers, or server responses") but relies on a single action verb ("reviewing...for security-sensitive information disclosure"), so it names the domain and one concrete action without comprehensive coverage.	3 / 5
Completeness	It has an explicit "Use when..." trigger clause and an implied what (reviewing responses for disclosure), but the what and when are somewhat conflated since "reviewing" appears in both, so the what could be more distinct.	4 / 5
Trigger Term Quality	It includes natural terms a user would say ("error handling middleware", "API route handlers", "server responses", "information disclosure") with good coverage, though it misses common synonyms like "stack traces" or "error leakage".	4 / 5
Distinctiveness Conflict Risk	It carves a clear niche (security-sensitive information disclosure in error responses) with distinct triggers and only minor overlap risk with broader security-review skills.	4 / 5
	Total	15 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: thedaviddias/Front-End-Checklist
Path: skills/stack-trace-exposure/SKILL.md
Commit: 30756a7

Reviewed: 15 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.