tessl-labs/input-sanitization
Sanitize and validate user input at system boundaries — prevent XSS, SQL
94
89%
Does it follow best practices?
Impact
100%
1.20xAverage score across 6 eval scenarios
Passed
No known issues
Quality
Discovery
100%Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.
This is an excellent skill description that hits all the marks. It provides specific security vulnerabilities it addresses, uses natural terminology developers would search for, includes an explicit 'Use when...' clause with multiple trigger scenarios, and carves out a distinct niche around input validation and injection prevention.
| Dimension | Reasoning | Score |
|---|---|---|
Specificity | Lists multiple specific concrete actions: 'Sanitize and validate user input', 'prevent XSS, SQL injection, path traversal, command injection, SSRF, and malformed data'. Also specifies coverage areas: 'frontend, backend, file handling, and shell safety'. | 3 / 3 |
Completeness | Clearly answers both what ('Sanitize and validate user input... prevent XSS, SQL injection...') AND when ('Use when building any web app that accepts user input, when reviewing input handling, or when a security scan flags injection vulnerabilities'). | 3 / 3 |
Trigger Term Quality | Excellent coverage of natural security terms users would say: 'XSS', 'SQL injection', 'path traversal', 'command injection', 'SSRF', 'user input', 'web app', 'security scan', 'injection vulnerabilities'. These are terms developers naturally use when facing these issues. | 3 / 3 |
Distinctiveness Conflict Risk | Clear niche focused specifically on input validation and injection prevention at system boundaries. The specific vulnerability types (XSS, SQL injection, SSRF, etc.) and context (system boundaries, input handling) make it highly distinguishable from general security or coding skills. | 3 / 3 |
Total | 12 / 12 Passed |
Implementation
77%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
This is a strong, highly actionable security skill with excellent code examples covering multiple languages and frameworks. The workflow for input validation is clearly sequenced with explicit steps. The main weakness is length - the document could benefit from splitting detailed examples (ORM patterns, service layer patterns) into separate reference files to improve progressive disclosure and reduce token load for simpler use cases.
Suggestions
Consider splitting ORM-specific patterns (Prisma, Sequelize, SQLAlchemy) into a separate ORMS.md reference file to reduce main document length
The service layer business rules section is valuable but lengthy - could be moved to a SERVICE_LAYER.md with a brief summary in the main skill
Remove explanatory text that Claude already knows (e.g., 'A <form> on any website can POST...' explanation of CORS) to improve conciseness
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The skill is comprehensive but includes some redundancy (e.g., repeating Content-Type checks in multiple examples, explaining why forms can bypass CORS which Claude likely knows). Some sections could be tightened, though most content earns its place. | 2 / 3 |
Actionability | Excellent executable code examples across TypeScript, Python, and Go. Every pattern shows both WRONG and RIGHT approaches with copy-paste ready code. The checklist at the end provides concrete verification steps. | 3 / 3 |
Workflow Clarity | Clear 7-step validation sequence for API endpoints with explicit ordering. The 'Where to Validate: Layered Defense' table provides excellent structure. Service layer examples show validation checkpoints and error handling for state transitions. | 3 / 3 |
Progressive Disclosure | Content is well-organized with clear section headers, but the document is quite long (~400 lines) with all content inline. Some sections like ORM safety patterns or the complete service layer example could be split into referenced files. The verifier references at the end are good. | 2 / 3 |
Total | 10 / 12 Passed |
Validation
81%Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.
Validation — 9 / 11 Passed
Validation for skill structure
| Criteria | Description | Result |
|---|---|---|
skill_md_line_count | SKILL.md is long (564 lines); consider splitting into references/ and linking | Warning |
frontmatter_unknown_keys | Unknown frontmatter key(s) found; consider removing or moving to metadata | Warning |
Total | 9 / 11 Passed | |
Reviewed
Table of Contents