secrets

Declaratively register API keys and service credentials a template needs so they appear in the agent sidebar settings UI and the onboarding checklist. Use before adding any third-party credential or setup UI so API keys, OAuth connections, and scoped configuration use the correct shared primitive.

Quality

81%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

78%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-sequenced reference with concrete code, commands, and explicit validation guards, written as earned project-specific knowledge rather than padding. Its main weakness is structure: it is a single large file with no bundle references, so material that belongs one level deep is inlined.

Suggestions

Move the Google OAuth triage and the encryption/rotation internals into references/ files (e.g. references/google-oauth.md, references/encryption.md) and link to them one level deep, keeping only the rule and the probe command inline.

Extract the HTTP route signatures, Registered options table, and ad-hoc API into a references/api.md so SKILL.md reads as an overview with signaled pointers.

Tighten the split-brain narrative ("This has now shipped four times in one app (BigQuery, Jira, Pylon, Academy)") into the rule it supports to trim prose without losing the diagnostic signal.

Dimension	Reasoning	Score
Conciseness	The body is dense and almost entirely project-specific knowledge (split-brain failure, resolveCredential single-org gotcha, encryption-key precedence) rather than concepts Claude already knows, but the narrative prose around the split-brain bug and the depth of the Google OAuth triage could be trimmed.	4 / 5
Actionability	Provides copy-paste-ready code (registerRequiredSecret, readAppSecret action, resolveKeyReferences), concrete commands (npx agent-native doctor --only no-env-credentials, pnpm check:google-redirect-uris, curl health endpoints), a field-options table, and explicit HTTP route signatures covering the common cases.	5 / 5
Workflow Clarity	Sub-processes like the Credential Modeling Preflight and key rotation are clearly sequenced with an explicit validation guard (the doctor check) and a triage table with next actions, but the document is reference-shaped rather than one coherent linear workflow, leaving minor checkpoint gaps.	4 / 5
Progressive Disclosure	The ~435-line body is well-sectioned with headers but entirely monolithic — no references/, scripts/, or assets/ bundle files exist, and self-contained chunks (Google OAuth triage, encryption internals, Dispatch vault policy) that could live one level deep are inlined rather than split out.	3 / 5
	Total	16 / 20 Passed

Description

83%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that clearly answers both what the skill does and when to use it, with concrete credential/OAuth triggers. Minor gaps in synonym coverage and a small overlap risk with neighboring skills keep specificity and distinctiveness just below the top anchor.

Dimension	Reasoning	Score
Specificity	Names a concrete action ("Declaratively register API keys and service credentials") and the specific surfaces it touches (sidebar settings UI, onboarding checklist), plus OAuth and scoped configuration; it is mostly one verb applied to several nouns rather than a list of distinct verbs, so it sits just above the 3 anchor rather than at 5.	4 / 5
Completeness	It explicitly states both what ("Declaratively register API keys and service credentials ... so they appear in the agent sidebar settings UI and the onboarding checklist") and when ("Use before adding any third-party credential or setup UI"), with a concrete trigger phrase.	5 / 5
Trigger Term Quality	Uses natural developer terms ("API keys", "service credentials", "OAuth connections", "setup UI", "onboarding checklist") that a user would plausibly say, but omits common synonyms like "secrets", "tokens", or "webhook".	4 / 5
Distinctiveness Conflict Risk	It carves a clear niche (the shared credential-registration primitive in this template framework) with distinct triggers, though it borders on overlapping with the related onboarding/authentication/security skills it itself lists.	4 / 5
	Total	17 / 20 Passed

Validation

81%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 13 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
metadata_field	'metadata' should map string keys to string values	Warning
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	13 / 16 Passed

Repository: BuilderIO/agent-native
Path: .agents/skills/secrets/SKILL.md
Commit: a06e0ac

Reviewed: 14 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.