token-storage-security

Use when reviewing authentication implementation, setting up a new auth system, or evaluating whether the current token storage approach exposes the application to XSS-based token theft.

Quality

83%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

85%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-organized, actionable review skill with a clean one-level-deep reference into the verified rule.md bundle; the only weakness is a mildly redundant opening paragraph that explains a concept Claude already knows.

Suggestions

Trim or remove the opening paragraph, since its XSS/localStorage rationale is already covered in '## Explain' and is knowledge Claude already has.

Consider folding the one-line 'Explain' prompt into the Code Review or Check section to reduce a near-duplicate section.

Dimension	Reasoning	Score
Conciseness	The opening paragraph restates a concept Claude already knows ('localStorage is accessible to any JavaScript... A single XSS vulnerability... can exfiltrate all tokens silently') and duplicates the later '## Explain' section, so it is mostly efficient but could be tightened; not the lean every-token-earns-its-place level.	2 / 3
Actionability	Gives concrete, specific guidance — exact APIs to flag ('localStorage.setItem, sessionStorage.setItem, or document.cookie'), exact cookie flags ('httpOnly', 'Secure', 'SameSite=Strict (or Lax)'), and exact controls ('CSRF token', 'Origin check'); per the instruction-skill note, the absence of inline code is not penalized when guidance is this actionable.	3 / 3
Workflow Clarity	Sequences the review clearly via '## Check' → '## Fix' → '## Explain' → '## Code Review', with Check specifying what to verify (httpOnly storage, CSRF on state-changing requests); as a single-purpose review skill the action is unambiguous and not subject to the destructive/batch feedback-loop cap.	3 / 3
Progressive Disclosure	The body is a concise overview that signals a single one-level-deep reference ('see references/rule.md') for full implementation details, and that bundle file exists, giving clear navigation with content appropriately split.	3 / 3
	Total	11 / 12 Passed

Description

82%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A specific, well-triggered description anchored in a distinct security niche, but it leads entirely with the 'Use when' clause and never states a standalone capability, leaving the 'what' implied rather than explicit.

Suggestions

Prepend a concise capability statement (e.g., 'Reviews and hardens authentication token storage against XSS-based theft.') before the 'Use when' clause so the 'what' is explicit.

Add a few more natural trigger variants users might say (e.g., 'JWT storage', 'cookie security', 'session token review') to broaden coverage.

Dimension	Reasoning	Score
Specificity	Lists three concrete actions — 'reviewing authentication implementation, setting up a new auth system, or evaluating whether the current token storage approach exposes the application to XSS-based token theft' — matching the multiple-specific-actions anchor rather than the domain-plus-some-actions level below.	3 / 3
Completeness	The explicit 'Use when...' clause clearly answers when, but no standalone capability statement is given — the actions appear only embedded in the trigger clause, so 'what this does' is implied rather than distinctly stated, falling short of the both-what-and-when anchor.	2 / 3
Trigger Term Quality	Uses natural terms a security-focused user would actually say ('authentication implementation', 'auth system', 'token storage', 'XSS-based token theft'), giving good coverage rather than just some relevant keywords.	3 / 3
Distinctiveness Conflict Risk	Targets a narrow niche (token-storage XSS hardening in auth) with distinct triggers that are unlikely to overlap with or fire for unrelated skills.	3 / 3
	Total	11 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: thedaviddias/Front-End-Checklist
Path: skills/token-storage-security/SKILL.md
Commit: 48405aa

Reviewed: about 8 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.