authentication

How auth works in agent-native apps. Use when wiring login/signup, configuring auth modes, setting up organizations, protecting routes, or debugging session issues.

Quality

73%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./.agents/skills/authentication/SKILL.md

Quality

Content

63%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is densely informative with strong executable code and well-gated risky workflows, but it runs long and inlines Cross-App SSO / Desktop SSO detail that would be better split into reference files given the skill already points to an external doc for the full runbook.

Suggestions

Move the detailed Cross-App SSO flow and packaged Desktop workspace SSO subsection into a references/ file (e.g. cross-app-sso.md) and keep only a concise summary plus the existing doc link in SKILL.md, improving both conciseness and progressive_disclosure.

Tighten the Auth Modes table cells, which are long paragraph-style entries; extract the invariant prose (e.g. the local@localhost warning) into short bullets so the table stays scannable.

Add a short sequenced checklist with a validation step to the Local → Real Account Migration section, mirroring the canary rollout's verify-gated structure.

Dimension	Reasoning	Score
Conciseness	Mostly assumes Claude's intelligence and avoids explaining basic concepts, but the Cross-App SSO and packaged Desktop SSO subsections are densely verbose and inline material the skill itself defers to /docs/cross-app-sso, so it could be tightened; not a 4 because the over-explanation is more than minor.	3 / 5
Actionability	Provides concrete, executable guidance — `getSession(event)`, `defineAppRoles`/`requireAny`, the `defineEventHandler` 401 pattern, the `/sign-in?return=` redirect, and `AppProviders` JSX — with only minor gaps in the more declarative SSO/A2A sections.	4 / 5
Workflow Clarity	Risky operations have explicit checkpoints: the SSO canary rollout is a sequenced Off→verify→enable→verify→expand path, and org switching has a stop-and-confirm gate, so the destructive-operation cap is not triggered; minor gaps remain in less-sequenced flows like local→real migration.	4 / 5
Progressive Disclosure	Section headers give usable structure and the /docs/cross-app-sso reference is signaled, but no bundle files exist and a large block of SSO/Desktop content that the external doc reference implies belongs elsewhere is inlined in the SKILL.md body.	3 / 5
	Total	14 / 20 Passed

Description

83%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, well-structured description that clearly states both what the skill covers and when to use it with concrete trigger phrases. Minor gains are available from adding common synonyms and tightening the slightly generic "configuring auth modes" phrasing.

Dimension	Reasoning	Score
Specificity	Lists several concrete actions — "wiring login/signup", "setting up organizations", "protecting routes", "debugging session issues" — with only minor generic gaps like "configuring auth modes"; not a 5 because the leading "How auth works" frames the topic abstractly and SSO/MCP coverage from the body is absent.	4 / 5
Completeness	Explicitly answers both: "How auth works in agent-native apps" (what) and "Use when wiring login/signup, ... or debugging session issues" (when) with concrete trigger phrases, matching the top anchor exactly.	5 / 5
Trigger Term Quality	Natural user-facing phrases are present ("login/signup", "protecting routes", "debugging session issues", "organizations"), but common synonyms like "sign in", "log in", and "permissions" are missing, keeping it just below comprehensive.	4 / 5
Distinctiveness Conflict Risk	The "agent-native apps" scoping gives a clear niche and auth is a distinct concern, but "protecting routes" and "organizations" have minor overlap risk with the related `security` skill referenced in the body.	4 / 5
	Total	17 / 20 Passed

Validation

68%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 11 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
metadata_field	'metadata' should map string keys to string values	Warning
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning
relative_links	Relative link issues: 2 suspicious	Warning
referenced_paths_exist	Referenced path issues: 2 missing	Warning

	Total	11 / 16 Passed

Repository: BuilderIO/agent-native
Path: .agents/skills/authentication/SKILL.md
Commit: b0df876

Reviewed: 5 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.