authentication

How auth works in agent-native apps. Use when wiring login/signup, configuring auth modes, setting up organizations, protecting routes, or debugging session issues.

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

77%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A thorough, actionable reference with concrete code and strong guardrails/checkpoints for destructive operations. Its main weaknesses are verbosity in a few discursive sections and an essentially monolithic single-file layout with little content offloaded to reference files.

Suggestions

Move the detailed Remote MCP OAuth and Gating-the-App-Shell sections into separate reference files (e.g. references/oauth.md, references/ssr-shell.md) and link to them one level deep from SKILL.md to improve progressive disclosure.

Tighten the 'Stop And Confirm' and SSR sections by replacing the incident narratives with the concrete rule + the enforcing script, and relocate the '2026-04-29 credentials leak' date into a short 'past incidents / deprecated patterns' note rather than the main rule prose.

Consider a brief numbered checklist at the top of the Organizations section so the create/switch/migrate guardrails are scannable before the explanatory prose.

Dimension	Reasoning	Score
Conciseness	Mostly efficient and dense with framework-specific lore Claude would not know, but discursive sections (the org-creation warning, the SSR section that notes it "has regressed repeatedly") and an inline dated incident ("the 2026-04-29 credentials leak") could be tightened; it is not score 3 because not every token earns its place.	2 / 3
Actionability	Provides executable TS/TSX examples (getSession + 401, AppProviders wiring, sign-in redirect), specific env vars, and named functions/file paths — copy-paste ready rather than pseudocode.	3 / 3
Workflow Clarity	Sequenced processes carry explicit checkpoints: the SSO canary rollout (unset → one app → verify → expand → rollback) and the destructive org-switch guard ("Stop... get an explicit yes first", treat warnings as bug reports) supply validation and feedback loops.	3 / 3
Progressive Disclosure	Sections are well-organized and the one outbound reference ("Full runbook + flow detail: Cross-App SSO doc") is clearly signaled one level deep, but a large amount of detailed content (auth-modes table, Remote MCP OAuth, SSR gating) that could live in separate reference files is inline and no bundle files exist; it is not score 3 because content is not appropriately split.	2 / 3
	Total	10 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A concise, well-structured description that states the domain, lists several concrete capabilities, and provides an explicit Use-when trigger clause in third-person voice. It clearly distinguishes itself as agent-native auth.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — "wiring login/signup, configuring auth modes, setting up organizations, protecting routes, or debugging session issues" — rather than vague language, matching the multi-action anchor.	3 / 3
Completeness	Explicitly answers both what ("How auth works in agent-native apps") and when ("Use when wiring login/signup...") with an explicit Use-when clause, so it is not capped at 2.	3 / 3
Trigger Term Quality	Natural terms a user would say ("login/signup", "organizations", "protecting routes", "debugging session issues") are well covered; it is not score 2 because common variations are present rather than partially missing.	3 / 3
Distinctiveness Conflict Risk	Scoped to "agent-native apps" with auth-specific triggers (login/signup, auth modes, orgs, routes, sessions), giving a clear niche unlikely to fire for unrelated skills.	3 / 3
	Total	12 / 12 Passed

Validation

68%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 11 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
metadata_field	'metadata' should map string keys to string values	Warning
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning
relative_links	Relative link issues: 2 suspicious	Warning
referenced_paths_exist	Referenced path issues: 2 missing	Warning

	Total	11 / 16 Passed

Repository: BuilderIO/agent-native
Path: .agents/skills/authentication/SKILL.md
Commit: c1ee18b

Reviewed: 4 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.