CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

auth-nodejs-cloudbase

CloudBase Node SDK auth guide for server-side identity, user lookup, and custom login tickets. This skill should be used when Node.js code must read caller identity, inspect end users, or bridge an existing user system into CloudBase; not when configuring providers or building client login UI.

67

Quality

84%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

The canonical home for this skill is auth-nodejs-cloudbase in TencentCloudBase/CloudBase-AI-Toolkit

SKILL.md
Quality
Evals
Security

Quality

Content

75%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable — complete, executable scenarios with exact API shapes, constraints, and best practices — and well-structured with clear scenario routing and one-level-deep sibling references. The main weakness is redundancy: activation/routing guidance is repeated across three sections and init boilerplate repeats in every code block, which inflates the file beyond what a leaner SKILL.md plus reference files would cost.

Suggestions

Collapse the near-duplicate routing sections ("Activation Contract", "When to use this skill", and the closing "Summary") into a single use/don't-use section; the same boundaries are stated three times.

State the SDK init pattern once (it is already shown in the "How to use" section and Scenario 1) and trim the repeated `tcb.init({ env })` / `app.auth()` boilerplate from the remaining eight scenario code blocks, referencing 'using the init from Scenario 1'.

Move the bulk of the nine scenarios into a references/ file (e.g. references/scenarios.md), keeping SKILL.md as a lean overview with the API list and per-scenario 'Use this when' routing pointers, which would shorten the ~440-line main file.

DimensionReasoningScore

Conciseness

The scenario code and API listings are lean with no padding that explains concepts Claude already knows, but routing guidance is stated three times — the "Activation Contract" section, "When to use this skill", and the closing "Summary" are near-duplicates — and the `tcb.init({ env })` / `app.auth()` boilerplate repeats verbatim in all nine scenario code blocks. This fits 'mostly efficient but could be tightened': above anchor 2 because the bulk of the file (scenarios, API list, best practices) is genuinely efficient, below anchor 4 because the tripled routing sections and repeated init boilerplate are more than minor trim work.

3 / 5

Actionability

Nine complete, copy-paste-ready TypeScript scenarios cover the common cases (caller identity, end-user lookup by uid, query by phone/email/custom ID, client IP, ticket issuance) with exact parameter values (e.g. `platform: "PHONE"`, `platformId: "+86 13800000000"`, `refresh`/`expire` in ms) and explicit constraints ("Length 4–32 characters; allowed characters: letters, digits, and `_-#@(){}[]:.,<>+#~`"). Error handling is demonstrated with try/catch. This matches 'fully executable; copy-paste ready code; specific examples cover the common cases.'

5 / 5

Workflow Clarity

The "How to use this skill" section gives a clear five-step sequence (clarify runtime/responsibility → confirm env and SDK → pick scenario → follow API shapes exactly → consult official docs if unsure), and each scenario is labeled with 'Use this when...' routing. This fits 'clear sequence with most checkpoints present; minor validation gaps' — the fallback-to-docs step and demonstrated try/catch provide some checkpoints, but there is no explicit verify-the-result checkpoint; a 5 is not warranted because there are no true validation/feedback loops, and the destructive/batch cap does not apply since these are read-only lookup operations.

4 / 5

Progressive Disclosure

The body is well-organized with a clear section hierarchy, and the references that do exist — the sibling skills (`../auth-tool-cloudbase/SKILL.md`, `../auth-web-cloudbase/SKILL.md`, `../http-api-cloudbase/SKILL.md`) — are one level deep and clearly signaled with what each covers, including handling for missing siblings. This fits 'good structure; most content is appropriately placed; minor organization gaps': the gap is that ~250 lines of scenario code and API detail are inlined in a ~440-line SKILL.md that could be split into reference files, keeping it below the well-split anchor 5.

4 / 5

Total

16

/

20

Passed

Description

87%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description that clearly and explicitly states both what the skill covers and when to use it, with a valuable negative boundary distinguishing it from sibling skills. The only improvements are minor: adding a few natural trigger synonyms such as the npm package name or "cloud functions" would push keyword coverage to comprehensive.

DimensionReasoningScore

Specificity

The description lists several concrete capabilities — "server-side identity, user lookup, and custom login tickets" and "read caller identity, inspect end users, or bridge an existing user system into CloudBase" — matching the 'several specific actions; minor gaps in coverage' anchor. It is not a 5 because it omits coverage of capabilities the skill actually has (e.g. client-IP retrieval) and phrases one capability domain abstractly ("server-side identity"); it is above a 3 because more than 1-2 concrete actions are explicitly named.

4 / 5

Completeness

It explicitly answers both questions: what it does ("CloudBase Node SDK auth guide for server-side identity, user lookup, and custom login tickets") and when to use it ("This skill should be used when Node.js code must read caller identity, inspect end users, or bridge an existing user system into CloudBase"), with concrete trigger phrases plus an explicit negative boundary ("not when configuring providers or building client login UI"). This matches the top anchor exactly.

5 / 5

Trigger Term Quality

Natural phrases a user would say are present — "Node.js code", "read caller identity", "user lookup", "custom login tickets", "bridge an existing user system into CloudBase" — giving good keyword coverage. A few natural terms are missing, such as the npm package name "@cloudbase/node-sdk", "cloud functions" / 云函数, and "who is calling", which keeps it below the comprehensive-synonyms anchor of 5.

4 / 5

Distinctiveness Conflict Risk

The description occupies a clear niche (CloudBase Node SDK server-side auth) and the negative boundary clause ("not when configuring providers or building client login UI") explicitly separates it from adjacent sibling skills, minimizing wrong-skill triggering. It matches the 'clear niche with distinct triggers; minimal conflict risk' anchor.

5 / 5

Total

18

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository

TencentCloudBase/CloudBase-AI-Toolkit

Path

config/.claude/skills/auth-nodejs-cloudbase/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.