CtrlK
BlogDocsLog inGet started
Tessl Logo

oauth-expert

OAuth 2.0 and OpenID Connect expert for authorization flows, PKCE, and token management

61

Quality

72%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./crates/openfang-skills/bundled/oauth-expert/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

72%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is well-organized with concrete, specific guidance and clean section structure, but it carries some redundant explanatory padding and lacks explicit validation checkpoints for its verification-sensitive operations. Trimming the rationale and adding feedback loops would lift the weaker dimensions.

Suggestions

Cut the redundant opening paragraph and trim rationale Claude already knows (e.g., 'they are vulnerable to XSS attacks and accessible to any JavaScript on the page') to just the directive.

Add explicit validation checkpoints for verification-sensitive flows, e.g., after JWT validation list which claim failure should do (reject the token), and after token revocation confirm revocation succeeded before clearing session state.

Consider a short numbered sequence with a verify step for the PKCE and token-refresh techniques so the workflow is unambiguous rather than a single prose bullet.

DimensionReasoningScore

Conciseness

The bullets are dense and mostly efficient, but the opening paragraph restates the description and several bullets include rationale Claude already knows (e.g., why PKCE, why localStorage is XSS-vulnerable), so it could be tightened.

2 / 3

Actionability

For an instruction-oriented skill, the guidance is concrete and specific — naming exact claims to validate (iss, aud, exp, nbf), concrete token lifetimes (5-15 minutes), and specific RFCs (RFC 8693), telling Claude exactly what to do.

3 / 3

Workflow Clarity

Some sequences exist (the PKCE flow steps, the JWT claim checklist) but there are no explicit validation checkpoints or validate-fix-retry feedback loops for verification-heavy operations like JWT validation and token revocation.

2 / 3

Progressive Disclosure

The skill is under 50 lines with no external references needed and is cleanly organized into well-labeled sections (Key Principles, Techniques, Common Patterns, Pitfalls), satisfying the simple-skill bar.

3 / 3

Total

10

/

12

Passed

Description

72%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description identifies a clear, distinctive niche with strong natural trigger terms, but it lacks concrete action verbs and any explicit "Use when" guidance. Adding a trigger clause and concrete verbs would round it out.

Suggestions

Append a 'Use when...' clause naming the situations that should activate this skill (e.g., implementing login, securing an API, or handling OAuth/OIDC tokens).

Rewrite 'expert for authorization flows, PKCE, and token management' with concrete action verbs (e.g., 'Implement OAuth 2.0/OIDC authorization flows, configure PKCE, and manage token lifecycles').

Add common keyword variations users say such as 'OIDC', 'SSO', 'JWT', or 'login' to broaden trigger coverage.

DimensionReasoningScore

Specificity

The description names the domain and several concrete topics ("authorization flows, PKCE, and token management") but uses no action verbs, phrasing capabilities as "expert for" rather than listing concrete actions like implement, validate, or issue.

2 / 3

Completeness

It states what the skill covers but provides no "Use when..." clause or equivalent explicit trigger guidance, so the "when to use it" half is missing rather than stated.

2 / 3

Trigger Term Quality

It includes the natural terms users actually say for this domain — "OAuth 2.0", "OpenID Connect", "PKCE", "token management" — giving good coverage of primary trigger keywords.

3 / 3

Distinctiveness Conflict Risk

"OAuth 2.0 and OpenID Connect expert" carves out a clear, specialized niche with distinct triggers that are unlikely to conflict with other skills.

3 / 3

Total

10

/

12

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
RightNow-AI/openfang
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.