Content
57%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A well-structured, lean overview with good progressive disclosure, but it leans on explanatory padding and lacks executable examples and an explicit verification step. Adding concrete code and a verify checkpoint would substantially raise quality.
Suggestions
Replace the conceptual intro paragraph with (or move it into) a copy-paste-ready example: a full <script src="..." integrity="sha384-..." crossorigin="anonymous"> tag.
Provide the actual hash-generation command, e.g. `openssl dgst -sha384 -binary FILE | openssl base64 -A` instead of 'Generate hashes with openssl or online tools'.
Add a verification step after Fix (e.g., confirm each external CDN tag has both integrity and crossorigin, and that the hash matches the fetched content).
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The opening paragraph explains CDN compromise and SRI mechanics — a concept Claude already knows — adding padding; the remaining sections are otherwise lean. | 2 / 3 |
Actionability | Gives specific attribute-level guidance ('Add integrity="sha384-..."', 'pair with crossorigin="anonymous"') but no executable code or command — no complete example tag and no actual openssl hash-generation command. | 2 / 3 |
Workflow Clarity | The Check/Fix/Explain/Code Review sections provide a clear sequence, but there is no explicit validation or verification step confirming the fix is correct. | 2 / 3 |
Progressive Disclosure | The body is a concise overview with a well-signaled one-level-deep reference ('see references/rule.md', verified to exist) and organized sections, making navigation easy. | 3 / 3 |
Total | 9 / 12 Passed |