CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

paddle-customer-portal

Mint a Paddle customer portal session URL from a Next.js Server Action — the portal-vs-custom-billing-screen trade-off, auth, ownership, URL structure (overview vs deep links), and the security model.

64

Quality

80%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Medium

Suggest reviewing before use

Fix and improve this skill with Tessl

tessl review fix ./skills/customer-portal/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

81%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

An exceptionally actionable, secure-by-design skill: complete executable code, a coherent auth-first workflow, and a real verification checklist. Its main cost is length — boilerplate Supabase helpers and a padded decision table inflate the body without adding knowledge Claude lacks.

Suggestions

Compress or drop the full Supabase helper implementations, keeping only the service-role/no-cookies subtlety and the naming warning; the standard @supabase/ssr pattern is already known.

Tighten the portal-vs-custom table cells to one line of "when it fits" each; the prose repeats points made in the pitfall about portal-vs-custom choice.

If bundle files were added later, move the helper code and the extended URL-structure notes (view_subscription SDK gap, 25-ID limit) into a reference file to keep SKILL.md a lean overview.

DimensionReasoningScore

Conciseness

Most content earns its place (security model, pitfalls, verification), but ~50 lines of standard "@supabase/ssr" createServerClient boilerplate — code Claude already knows and which the skill itself admits is swappable ("if your project already has equivalent helpers, use those instead") — plus the very wordy portal-vs-custom table cells could be tightened or externalized. It matches anchor 3: mostly efficient with some unnecessary explanation, rather than anchor 4's minor trimmable instances.

3 / 5

Actionability

Fully executable, copy-paste-ready guidance: the complete Server Action with imports and error handling, the client button component, both Supabase helpers, the env-var block, the exact SDK call signature (`paddle.customerPortalSessions.create(customerId, subscriptionIds)`), and edge-case handling (no-customer, 400 on foreign subscription IDs). This matches anchor 5's complete, common-case-covering example.

5 / 5

Workflow Clarity

The Server Action is explicitly numbered (authenticate → lookup customer_id → mint session → return URL only) with in-code checkpoints, ApiError handling with a retry-able user message, and a dedicated "Verify the integration" checklist with feedback-oriented assertions (logged out returns error and SDK NOT called, URL unique per click to catch caching). This matches anchor 5's explicit validation and error-recovery loop; the operation is neither destructive nor batch, so no cap applies.

5 / 5

Progressive Disclosure

No bundle files exist, so all content lives in a single, well-sectioned SKILL.md with one-level-deep, clearly labeled external pointers (Paddle API reference, Node SDK docs, the starter kit's specific source directories) and inline sibling-skill references ("see `subscription-sync`"). This fits anchor 4's good structure with minor gaps — the Supabase helpers and the comparison table are content that could sit in a reference file — rather than anchor 5, which expects a lean overview with well-signaled split-out references.

4 / 5

Total

17

/

20

Passed

Description

70%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A highly specific, distinct description with a crisp concrete action, but it lacks any explicit "when to use" trigger guidance, which caps completeness. Adding a short "Use when..." clause referencing natural user phrasings (e.g., a "Manage subscription" button, letting customers self-service billing) would lift it substantially.

Suggestions

Add an explicit trigger clause, e.g., "Use when wiring a 'Manage subscription' button or sending customers to Paddle-hosted billing self-service in a Next.js app."

Include the natural user-side phrases users actually say — "manage subscription", "billing portal", "let customers cancel/update their own subscription" — to improve trigger-term coverage.

Trim or reframe the trailing topic enumeration ("ownership", "URL structure") toward user-visible outcomes so more of the description works as triggers.

DimensionReasoningScore

Specificity

"Mint a Paddle customer portal session URL from a Next.js Server Action" is a fully concrete action naming the exact API surface, framework, and sub-topics ("auth, ownership, URL structure (overview vs deep links), and the security model"), which is more concrete than anchor 3's generic action pair but stops short of anchor 4's list of several distinct actions — the topic enumeration conveys scope rather than additional actions.

4 / 5

Completeness

The "what" is explicit and clear (mint a portal session URL from a Server Action), but there is no "Use when..." clause or equivalent trigger guidance — the dash-delimited topics are content areas, not usage conditions. Per the judging guideline, a missing explicit trigger clause caps completeness at 3; it is not lower because the what is unambiguous and the context is weakly implied by the enumeration.

3 / 5

Trigger Term Quality

Natural domain terms are present — "Paddle customer portal", "portal session URL", "Next.js Server Action", "billing" — matching what a user on this stack would say. A few common phrasings are missing ("manage subscription button", "billing portal", "cancel subscription"), keeping it below anchor 5's comprehensive synonym coverage.

4 / 5

Distinctiveness Conflict Risk

"Paddle customer portal session URL from a Next.js Server Action" carves out a clear niche with distinct triggers, and explicitly flagging the "portal-vs-custom-billing-screen trade-off" further separates it from sibling Paddle skills (custom billing UI approaches). Conflict risk is minimal.

5 / 5

Total

16

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

PaddleHQ/paddle-agent-skills

Path

skills/customer-portal/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.