top-web-vulnerabilities

This skill should be used when the user asks to "identify web application vulnerabilities", "explain common security flaws", "understand vulnerability categories", "learn about injection attacks", "review access control weaknesses", "analyze API security issues", "assess security misconfigurations", "understand client-side vulnerabilities", "examine mobile and IoT security flaws", or "reference the OWASP-aligned vulnerability taxonomy". Use this skill to provide comprehensive vulnerability definitions, root causes, impacts, and mitigation strategies across all major web security categories.

Quality

61%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/top-web-vulnerabilities/SKILL.md

Quality

Content

38%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A thorough, well-organized vulnerability catalog with accurate mitigations and useful summary tables, but it is a token-heavy monolith that re-teaches concepts Claude already knows and lacks executable examples, validation checkpoints, or split-out reference files. The structured tables and category groupings keep it from scoring lower.

Suggestions

Move the per-vulnerability catalog (Phases 1-15) into a references/ file (e.g. VULNERABILITIES.md) and keep SKILL.md as a concise overview pointing to it, which would materially improve both conciseness and progressive_disclosure.

Cut definitional padding Claude already knows (e.g. what SQL injection or XSS is) and keep only the skill-specific framing: the category structure, the 1-100 numbering scheme, and the OWASP mapping.

For the highest-value categories, replace generic mitigation bullets with one concrete executable example (a parameterized-query snippet, a CSP header, a Burp/ZAP check command) to lift actionability above 3.

Dimension	Reasoning	Score
Conciseness	The body is a 500+ line monolithic catalog restating well-known vulnerability definitions, root causes, and mitigations that Claude already knows (e.g. 'SQL Injection: Malicious SQL code inserted into input fields'), so it is noticeably padded relative to the token budget; it is above a 1 because entries are terse bullet points rather than long prose.	2 / 5
Actionability	Mitigations are concrete and correct but stated as generic imperative bullets ('Use parameterized queries/prepared statements, input validation, least privilege database accounts') rather than executable code or commands, and the only executable snippet is a static security-header block; it sits between anchors 3 and 4 but leans toward 3 due to the absence of runnable examples.	3 / 5
Workflow Clarity	The 15 'Phase' sections provide a rough assessment sequence, but there are no validation checkpoints, no feedback loops, and no ordering rationale beyond grouping by category, which matches the anchor 'Steps listed but validation gaps'.	3 / 5
Progressive Disclosure	The entire 100-item reference is inlined as one wall-of-text SKILL.md with no separate reference files (no references/, scripts/, or assets/ bundles exist) and the in-file navigation relies on a single Quick Reference table, so content that clearly belongs in separate files is inlined.	2 / 5
	Total	10 / 20 Passed

Description

83%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, trigger-rich description that explicitly covers both capability and activation with concrete user-language phrases. Minor gains are available from sharper action verbs and synonym/extension coverage to lift specificity and trigger quality.

Suggestions

Replace generic deliverable verbs ('provide comprehensive ... definitions') with sharper actions matching the catalog, e.g. 'Catalog, define, and assess the top 100 web vulnerabilities by category'.

Add concrete synonyms and extension/format cues that users actually say, e.g. 'OWASP Top 10', 'CWE', '.api endpoints', to push trigger_term_quality from 4 to 5.

Tighten the broadest terms ('common security flaws', 'security misconfigurations') into the OWASP-aligned niche wording to reduce overlap with general code-audit or security-review skills.

Dimension	Reasoning	Score
Specificity	The description lists several concrete actions ('provide comprehensive vulnerability definitions, root causes, impacts, and mitigation strategies') tied to a defined domain, but the verbs are somewhat generic deliverable phrasing rather than the full breadth of the skill's coverage, leaving minor gaps.	4 / 5
Completeness	It explicitly answers both 'what' ('provide comprehensive vulnerability definitions, root causes, impacts, and mitigation strategies across all major web security categories') and 'when' ('This skill should be used when the user asks to ... Use this skill to ...') with concrete trigger phrases.	5 / 5
Trigger Term Quality	Ten quoted natural-language trigger phrases ('identify web application vulnerabilities', 'review access control weaknesses', 'analyze API security issues', etc.) cover what users would actually say, but it lacks concrete synonyms and file/extension cues that would push it to a 5.	4 / 5
Distinctiveness Conflict Risk	The OWASP-aligned web-vulnerability taxonomy niche is fairly distinct and the quoted trigger phrases are specific to it, but the broad 'security flaws'/'security misconfigurations' wording leaves minor overlap risk with general security-review or code-audit skills.	4 / 5
	Total	17 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (544 lines); consider splitting into references/ and linking	Warning

	Total	15 / 16 Passed

Repository: zebbern/claude-code-guide
Path: skills/top-web-vulnerabilities/SKILL.md
Commit: 9d252b3

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.