x-frame-options

Use when reviewing HTTP response headers for clickjacking protection on any web application with authenticated user actions.

Quality

72%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/x-frame-options/SKILL.md

Quality

Content

71%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a lean, well-structured overview that appropriately delegates implementation detail to one reference file, with a clear review workflow; its main weakness is that the body itself contains no executable code, relying entirely on the reference.

Suggestions

Inline one minimal copy-paste-ready header example (e.g. `X-Frame-Options: DENY`) so the body is actionable without opening the reference.

Add an explicit verification checkpoint step (e.g. curl the live response to confirm the header is present) to strengthen the workflow's validation.

Trim the 'Why It Matters' section to avoid re-stating the iframe attack already covered in the opening paragraph.

Dimension	Reasoning	Score
Conciseness	The body is compact and well-organized with lean Quick Reference bullets, though the 'Why It Matters' section partially re-states the iframe attack scenario already given in the intro, a minor instance of over-explanation.	4 / 5
Actionability	The body gives concrete value directives ('Add X-Frame-Options: DENY', 'use SAMEORIGIN', 'use CSP frame-ancestors') but defers all executable code/config to references/rule.md, so the body itself lacks copy-paste-ready examples.	3 / 5
Workflow Clarity	The Check/Fix/Explain/Code Review sections form a clear review sequence, and Code Review mentions verifying against the effective production response, but there is no explicit validation checkpoint step in the body.	4 / 5
Progressive Disclosure	The body is a concise overview with a single well-signaled one-level-deep reference (references/rule.md, confirmed to exist), keeping detailed implementation correctly out of the main file.	5 / 5
	Total	16 / 20 Passed

Description

73%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is clear and well-targeted with an explicit Use-when trigger and a distinct niche, but its capability statement covers a single action rather than a comprehensive set of concrete actions.

Suggestions

Expand the 'what' to list concrete actions beyond reviewing, e.g. 'inspect, set, or verify X-Frame-Options and CSP frame-ancestors headers'.

Add natural trigger synonyms such as 'X-Frame-Options', 'frame-ancestors', or 'iframe embedding' to improve keyword coverage.

Dimension	Reasoning	Score
Specificity	Names the domain (HTTP response headers, clickjacking protection) and one concrete action ('reviewing'), but does not list multiple specific actions, fitting the 1-2 concrete actions anchor rather than the comprehensive coverage of 4-5.	3 / 5
Completeness	Explicitly states both what ('reviewing HTTP response headers for clickjacking protection') and when ('Use when reviewing... on any web application with authenticated user actions'); the what is single-action and could be more specific, keeping it just below 5.	4 / 5
Trigger Term Quality	Includes natural terms like 'HTTP response headers', 'clickjacking', and 'web application with authenticated user actions' that a reviewer would say, but misses common synonyms such as 'X-Frame-Options', 'framing', or 'iframe'.	4 / 5
Distinctiveness Conflict Risk	Targets a clear niche (clickjacking protection headers) with distinct triggers and minimal overlap risk with other skills.	5 / 5
	Total	16 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: thedaviddias/Front-End-Checklist
Path: skills/x-frame-options/SKILL.md
Commit: 30756a7

Reviewed: 4 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.