CtrlK
BlogDocsLog inGet started
Tessl Logo

giuseppe-trisciuoglio/developer-kit

Comprehensive developer toolkit providing reusable skills for Java/Spring Boot, TypeScript/NestJS/React/Next.js, Python, PHP, AWS CloudFormation, AI/RAG, DevOps, and more.

89

Quality

89%

Does it follow best practices?

Impact

Pending

No eval scenarios have been run

SecuritybySnyk

Risky

Do not use without reviewing

Overview
Quality
Evals
Security
Files

Quality

Discovery

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

This is a strong skill description that clearly articulates specific capabilities (JWT token generation, Bearer/cookie auth, OAuth2, RBAC), includes abundant natural trigger terms developers would use, and provides an explicit 'Use when' clause. The version-specific framework references (Spring Boot 3.5.x, Spring Security 6.x) and named libraries (JJWT) create a distinct, well-scoped identity that minimizes conflict risk.

DimensionReasoningScore

Specificity

Lists multiple specific concrete actions: JWT token generation with JJWT, Bearer/cookie authentication, database/OAuth2 integration, and RBAC/permission-based access control. These are detailed, actionable capabilities.

3 / 3

Completeness

Clearly answers both 'what' (JWT auth patterns covering token generation, Bearer/cookie auth, OAuth2 integration, RBAC) and 'when' ('Use when implementing authentication or authorization in Spring Boot applications'). The explicit 'Use when...' clause is present.

3 / 3

Trigger Term Quality

Includes strong natural keywords users would say: 'JWT', 'authentication', 'authorization', 'Spring Boot', 'token generation', 'Bearer', 'cookie authentication', 'OAuth2', 'RBAC', 'Spring Security'. These cover a wide range of terms a developer would naturally use.

3 / 3

Distinctiveness Conflict Risk

Highly specific niche: JWT authentication in Spring Boot 3.5.x with Spring Security 6.x. The combination of framework version specificity, JWT focus, and named libraries (JJWT) makes it very unlikely to conflict with other skills.

3 / 3

Total

12

/

12

Passed

Implementation

72%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

This is a well-structured, comprehensive skill that effectively balances inline code examples with progressive disclosure to reference files. Its main strengths are strong actionability with executable Java code for all core components and excellent organization across reference files. The primary weaknesses are some verbosity in the overview/trigger sections and missing validation checkpoints in the multi-step workflow for what is a security-critical implementation.

Suggestions

Add explicit validation checkpoints between workflow steps, e.g., 'After Step 4, verify the filter intercepts requests by hitting a protected endpoint and confirming 401' and 'After Step 5, test that public endpoints return 200 and protected ones return 401 before proceeding.'

Trim the 'When to Use' section to 3-4 key triggers instead of 9 bullet points — Claude can infer related phrasings from a few examples.

DimensionReasoningScore

Conciseness

The skill is mostly efficient but includes some unnecessary sections like the verbose 'When to Use' trigger list and the 'Overview' section that largely restates the title/description. The 'Best Practices' and 'Constraints and Warnings' sections have some overlap. However, the code examples are lean and the reference table is well-organized.

2 / 3

Actionability

The skill provides fully executable Java code for the core components (JwtService, JwtAuthenticationFilter, SecurityFilterChain, AuthController, tests) with specific configuration YAML and concrete annotations. The code is copy-paste ready and covers the critical implementation pieces, with references for complete implementations.

3 / 3

Workflow Clarity

The 9-step workflow is clearly sequenced and logically ordered from dependencies through testing. However, there are no explicit validation checkpoints between steps — for example, no guidance to verify the SecurityFilterChain is working before adding authorization rules, or to test token generation before implementing the filter. For a security-sensitive multi-step process, the absence of verification steps between stages is a gap.

2 / 3

Progressive Disclosure

Excellent progressive disclosure — the main skill provides a clear overview with executable core snippets, while detailed implementations (complete JwtService, cookie variants, entity models, test suites, OAuth2 integration) are cleanly delegated to 14 well-organized reference files. References are one level deep, clearly signaled with descriptive links, and summarized in a navigation table.

3 / 3

Total

10

/

12

Passed

Validation

90%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation10 / 11 Passed

Validation for skill structure

CriteriaDescriptionResult

allowed_tools_field

'allowed-tools' contains unusual tool name(s)

Warning

Total

10

/

11

Passed

Reviewed

Table of Contents