CtrlK
BlogDocsLog inGet started
Tessl Logo

testland/eslint-security-rules

Configures and runs `eslint-plugin-security` (14 detect-* rules covering injection, path traversal, ReDoS, unsafe buffers, and bidi trojan-source) plus `eslint-plugin-no-unsanitized` (DOM XSS via `innerHTML`, `outerHTML`, `document.write`, `insertAdjacentHTML`) as the JS/TS first-party SAST layer; covers flat config setup, per-rule suppression with justification templates, SARIF output via `@microsoft/eslint-formatter-sarif` for GitHub Code Scanning upload, and CI gating on ESLint exit code 1. Use when the project is JS or TS and needs an in-process security lint pass without a separate SAST server.

75

Quality

94%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

Overview
Quality
Evals
Security
Files

Quality

Content

85%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, actionable skill body with strong progressive disclosure and a clear gated workflow. Its only weakness is mild verbosity in the Example section and Step 4 prose that could be trimmed.

Suggestions

Tighten the Example section: the 'ESLint output (stylish)' block largely restates the triggering findings, and one XSS alternative (textContent vs setHTML) would suffice.

Compress the Step 4 prose by leading with the suppression templates and folding the quarterly-audit cadence into a one-line note.

Consider moving the legacy .eslintrc snippet into the reference file so the spine stays focused on the current flat-config path.

DimensionReasoningScore

Conciseness

The spine is efficient and delegates exhaustive rule tables to the reference, but the Example section (a stylish-output block plus multiple rewrite variants) and some Step 4 prose could be tightened without losing clarity.

2 / 3

Actionability

Provides fully executable, copy-paste-ready guidance throughout: npm install commands, a complete eslint.config.js, suppression snippets, the scoped-formatter SARIF command, and a GitHub Actions upload step.

3 / 3

Workflow Clarity

A clearly sequenced seven-step process with an explicit verification checkpoint ('Gate CI on exit code 1'), a suppression template with required fields, and a quarterly audit cadence — checkpoints are explicit rather than implicit.

3 / 3

Progressive Disclosure

The spine keeps setup, triage, and SARIF/JSON commands while the exhaustive rule catalog and full CI workflow live one level deep in references/eslint-security-reference.md, clearly signaled via two markdown links.

3 / 3

Total

11

/

12

Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that names specific plugins, concrete actions, and outputs, with an explicit 'Use when' trigger and a clear niche. It answers what and when without vague fluff or over-claims.

DimensionReasoningScore

Specificity

Lists multiple concrete actions: 'flat config setup', 'per-rule suppression with justification templates', 'SARIF output via @microsoft/eslint-formatter-sarif', and 'CI gating on ESLint exit code 1', matching the 'lists multiple specific concrete actions' anchor.

3 / 3

Completeness

Explicitly answers both: what ('Configures and runs eslint-plugin-security… plus eslint-plugin-no-unsanitized…') and when ('Use when the project is JS or TS and needs an in-process security lint pass without a separate SAST server').

3 / 3

Trigger Term Quality

Covers natural domain terms a user would say — 'JS or TS', 'security lint pass', 'SAST', 'ESLint', 'SARIF', 'GitHub Code Scanning', 'DOM XSS', 'innerHTML' — giving good coverage rather than just generic jargon.

3 / 3

Distinctiveness Conflict Risk

Names the two specific plugins and positions them as 'the JS/TS first-party SAST layer', a clear niche unlikely to trigger for unrelated skills.

3 / 3

Total

12

/

12

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Reviewed

Table of Contents