CtrlK
BlogDocsLog inGet started
Tessl Logo

subresource-integrity

Use when reviewing templates, rendered HTML, or shared components related to Add Subresource Integrity to external scripts. Validate the final browser-facing markup, not just the source framework abstraction.

56

Quality

63%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/subresource-integrity/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

53%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is well-structured with clean sectioning and a properly signaled single reference file, but it over-explains a familiar concept in the intro and delegates the executable details (hash command, verification) entirely to the reference without surfacing them.

Suggestions

Trim or remove the intro paragraph that explains what SRI is and why CDN trust matters; Claude already knows this.

Surface the key executable command (e.g. `openssl dgst -sha384 -binary | openssl base64 -A`) in the body's Fix section so guidance is copy-paste ready.

Add a brief verification checkpoint in the body (e.g. 'confirm rendered HTML carries integrity+crossorigin on every CDN tag') rather than relegating all verification to references.

DimensionReasoningScore

Conciseness

Mostly efficient with a tight Quick Reference, but the intro paragraph re-explains what SRI is and why CDN trust matters — concepts Claude already knows.

3 / 5

Actionability

Concrete attribute names are given (integrity, crossorigin) but the executable hash-generation command lives only in references; the body's Fix section says 'Generate the SHA-384 hashes' without the command.

3 / 5

Workflow Clarity

Check/Fix/Explain/Code Review sections give a rough sequence, but no validation or verification checkpoint is surfaced in the body (it exists only in references).

3 / 5

Progressive Disclosure

Well-organized sections with a single one-level-deep reference (references/rule.md, verified to exist) clearly signaled, though the Explain section restates concept already covered in the reference.

4 / 5

Total

13

/

20

Passed

Description

73%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is tightly scoped to a distinct niche with a clear use-when trigger and natural review-oriented keywords. Its main weakness is specificity: it states 1-2 actions rather than a comprehensive set, and omits common synonyms like 'CDN' and 'SRI'.

Suggestions

Add concrete actions beyond 'reviewing/Validate', e.g. 'flag missing integrity attributes, generate SHA-384 hashes, add integrity and crossorigin attributes'.

Include common trigger synonyms such as 'CDN', 'SRI', 'integrity hash', and '<script>/<link> tags' to broaden natural-language matching.

DimensionReasoningScore

Specificity

Names the concrete domain (templates, rendered HTML, shared components) and the actions 'reviewing' and 'Validate', but offers only 1-2 actions rather than a comprehensive list.

3 / 5

Completeness

An explicit 'Use when...' trigger answers 'when', and 'Validate the final browser-facing markup' answers 'what', though the 'what' leans partly on the rule title rather than fully stated actions.

4 / 5

Trigger Term Quality

Natural terms like 'templates', 'rendered HTML', 'shared components', and 'external scripts' are present, though common synonyms like 'CDN', 'SRI', and 'integrity hash' are missing.

4 / 5

Distinctiveness Conflict Risk

Targets a clear niche (SRI on external CDN scripts in rendered markup) with distinct triggers and minimal overlap with other skills.

5 / 5

Total

16

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

Total

15

/

16

Passed

Repository
thedaviddias/Front-End-Checklist
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.