Conciseness

The body is lean and assumes competence, but the intro paragraph ("Install and wire @convex-dev/auth... correctly, including the auth.config.ts that's the #1 real-world auth footgun") echoes the frontmatter description, and the Rules section restates workflow steps 1, 3, 5, and 6 nearly verbatim. These are minor instances of over-explanation that could be trimmed, fitting anchor 4 rather than 3, since nothing explains concepts Claude already knows.

Actionability

Guidance is fully executable and copy-paste ready: the exact jose key-generation one-liner, the `npx convex env set "JWT_PRIVATE_KEY=$JWT"` NAME=VALUE form with the leading-dash flag-parsing gotcha called out, `pnpm add jose` for the pnpm hoisting issue, and `npx shadcn@latest add <name>` for UI primitives. Specific commands cover the common cases, matching anchor 5.

Workflow Clarity

A clear six-step numbered sequence with an explicit validation checkpoint ("Verify a sign-in round-trips before declaring done") and critical gotchas inline at each step. It falls short of anchor 5 because there is no error-recovery feedback loop (no "if sign-in fails, check X") — the validation step says what to do but not what to do on failure.

Progressive Disclosure

The skill is under 50 lines, single-purpose, and needs no external references; the body is well-organized into Workflow and Rules sections with no inlined content that belongs in a separate file. Per the rubric's simple-skill guideline this earns anchor 5.

Specificity

"Add authentication (passkeys/OAuth)" and "including the auth.config.ts wiring" name the domain and two concrete actions, but coverage is not comprehensive — client hooks, sign-in UI, and key generation from the body are absent. It is above anchor 2 because the actions are concrete, not generic.

Completeness

The "what" is clear (add authentication plus auth.config.ts wiring to a Convex app), but there is no "Use when..." clause or equivalent explicit trigger guidance, which caps completeness at 3 per the judging guidelines. "to the current Convex app" only weakly implies the "when", so this is not anchor 4.

Trigger Term Quality

Natural terms like "authentication", "passkeys", "OAuth", and "Convex" are present and would be said by users needing this skill. It falls short of anchor 5 because common variations such as "login", "sign-in", or "sign in" are missing.

Distinctiveness Conflict Risk

"current Convex app" and "auth.config.ts" carve a distinct niche with minimal conflict risk against non-Convex skills. Not anchor 5 because the generic "authentication/passkeys/OAuth" phrasing could still overlap with other auth-related skills.