CtrlK
BlogDocsLog inGet started
Tessl Logo

auth-nodejs-cloudbase

CloudBase Node SDK auth guide for server-side identity, user lookup, and custom login tickets. This skill should be used when Node.js code must read caller identity, inspect end users, or bridge an existing user system into CloudBase; not when configuring providers or building client login UI.

67

Quality

81%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

75%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-structured Node auth reference with executable patterns and clear sibling-skill routing. Its main weakness is token efficiency from repeated init boilerplate and overlapping usage/summary sections.

Suggestions

Define the `tcb.init({ env })` / `app.auth()` boilerplate once and reference it, instead of repeating it in all 9 scenario code blocks.

Consolidate the overlapping 'Activation Contract', 'When to use this skill', and 'Summary' sections to remove redundant trigger guidance.

Add an explicit verify/authorize checkpoint in the custom-ticket and caller-identity workflows (e.g. confirm authorization before returning a ticket) to strengthen the workflow's validation step.

DimensionReasoningScore

Conciseness

Mostly efficient and free of basic-concept padding, but the full `tcb.init`/`app.auth()` boilerplate is repeated verbatim in all 9 scenarios, and the 'Activation Contract', 'When to use this skill', and 'Summary' sections overlap substantially.

3 / 5

Actionability

Fully executable, copy-paste-ready TypeScript for every scenario with real method names, parameter shapes, and varied concrete examples (phone, email, custom ID), plus explicit customUserId constraints.

5 / 5

Workflow Clarity

A clear 5-step selection workflow (clarify runtime → confirm env/SDK → pick scenario → follow API shapes → consult docs if unsure) is sequenced, with try/catch error handling in best practices; minor gap is the absence of explicit verify-after-call checkpoints for the security-sensitive ticket/authorization paths.

4 / 5

Progressive Disclosure

No bundle files exist; the single file is well-organized into clearly headed sections, and sibling-skill references are one level deep and clearly signaled (e.g. '../auth-tool-cloudbase/SKILL.md'), though the API reference and scenario bulk are inlined rather than split out.

4 / 5

Total

16

/

20

Passed

Description

87%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that clearly states both capability and activation triggers with useful negative guidance. It is slightly under-comprehensive on action coverage and a few natural trigger phrasings sit in the body rather than the description.

Suggestions

Consider mentioning IP/security logging ('getClientIP') in the description so its action coverage is fully comprehensive.

Fold one or two natural user phrasings like 'who is calling' or 'server-side auth' into the description to broaden trigger-term match.

DimensionReasoningScore

Specificity

Lists several concrete actions ('read caller identity, inspect end users, or bridge an existing user system into CloudBase', 'custom login tickets', 'user lookup'), with a minor gap — IP/security logging covered in the body is absent from the description.

4 / 5

Completeness

Explicitly answers both what ('server-side identity, user lookup, and custom login tickets') and when ('This skill should be used when Node.js code must read caller identity, inspect end users, or bridge...'), plus a concrete negative trigger ('not when configuring providers or building client login UI').

5 / 5

Trigger Term Quality

Good natural-term coverage ('Node.js code', 'caller identity', 'user lookup', 'custom login tickets', 'server-side identity'), but a few common phrasings a user might say ('server-side auth', 'who is calling') appear only in the body, not the description.

4 / 5

Distinctiveness Conflict Risk

Clear niche (CloudBase Node SDK server-side auth) with explicit 'not when...' disambiguation against sibling provider/UI skills, giving minimal conflict risk.

5 / 5

Total

18

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository
TencentCloudBase/CloudBase-AI-Toolkit
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.