secrets

Declaratively register API keys and service credentials a template needs so they appear in the agent sidebar settings UI and the onboarding checklist. Use for any third-party API key (OpenAI, Stripe, Twilio, etc.) and for surfacing OAuth connections in the unified settings UI.

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

77%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with executable code and real validation guardrails for sensitive credential operations. Its main weaknesses are length and a monolithic structure that could split detailed reference material into separate files.

Suggestions

Move the HTTP routes table, storage/encryption details, ad-hoc key API, and dispatch-vault policy into a references/ file (e.g. SECRETS_REFERENCE.md) and link to it from SKILL.md to improve progressive disclosure.

Tighten the split-brain and 'resolveCredential sees exactly one organization' sections to the rule plus a one-line failure mode, keeping the concrete fix and the doctor/grep verification steps.

Keep the inline focus on the two core workflows (register a secret, read a secret) and delegate the OAuth, ad-hoc, and dispatch edge cases to sub-sections or reference files.

Dimension	Reasoning	Score
Conciseness	Most content is non-obvious domain knowledge that earns its place, but the extended split-brain narrative and the 'resolveCredential sees exactly one organization' section could be tightened without losing the key guidance.	2 / 3
Actionability	Provides complete, executable TypeScript (registerRequiredSecret with a validator, readAppSecret, defineAction, resolveKeyReferences/validateUrlAllowlist) plus concrete commands like 'npx agent-native doctor --only no-env-credentials'.	3 / 3
Workflow Clarity	Credential-touching changes have an explicit validation checkpoint (the doctor guard) and a grep-verification feedback step for resolveCredential calls, with clear error-recovery reasoning.	3 / 3
Progressive Disclosure	Sections are well-organized, but the HTTP routes, storage/encryption, ad-hoc keys, and dispatch-vault detail all live inline in a ~300-line SKILL.md with no reference files to offload the deeper material.	2 / 3
	Total	10 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is concise, third-person, and answers both what the skill does and when to use it with concrete, natural trigger terms. It is a strong, low-conflict description.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'register API keys and service credentials', 'appear in the agent sidebar settings UI and the onboarding checklist', and 'surfacing OAuth connections' — rather than vague language.	3 / 3
Completeness	Clearly states what it does (declaratively registers credentials so they surface in the UI/checklist) and includes an explicit 'Use for…' trigger clause answering when to invoke it.	3 / 3
Trigger Term Quality	Covers natural terms users would say ('API key', 'service credentials', 'OAuth connections') and names common vendors (OpenAI, Stripe, Twilio) that match real requests.	3 / 3
Distinctiveness Conflict Risk	Targets a clear niche — declarative credential registration for templates — with distinct triggers unlikely to fire for unrelated skills.	3 / 3
	Total	12 / 12 Passed

Validation

81%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 13 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
metadata_field	'metadata' should map string keys to string values	Warning
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	13 / 16 Passed

Repository: BuilderIO/agent-native
Path: .agents/skills/secrets/SKILL.md
Commit: c1ee18b

Reviewed: 5 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.