CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

auth-tool-cloudbase

CloudBase auth provider configuration and login-readiness guide. This skill should be used when users need to inspect, enable, disable, or configure auth providers, publishable-key prerequisites, login methods, SMS/email sender setup, or other provider-side readiness before implementing a client or backend auth flow.

61

Quality

77%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./plugin/cloudbase/skills/auth-tool-cloudbase/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

57%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a well-structured routing layer that concretely separates MCP tool domains and defers executable detail appropriately to extended-guide.md, but it suffers from a dangling checklist.md link, implicit rather than explicit verification checkpoints, and several dense sections that could be tightened or externalized. These keep an otherwise good skeleton from scoring higher.

Suggestions

Fix the dangling "[Authentication Activation Checklist](checklist.md)" link: either package checklist.md (and add it to the Reference index) or remove the link and inline the essential checklist items.

Add explicit verification checkpoints to the workflow, e.g. after enabling a provider, re-query login configuration via queryAppAuth to confirm the change before handing off to an implementation skill.

Move the dense anonymous-login/401 paragraph and the credential-scope detail into references/extended-guide.md, and merge the "Sibling skills (local only)" section with the "Then also read" routing to cut duplicated guidance.

DimensionReasoningScore

Conciseness

The body is structured and assumes Claude's competence, but several parts could be tightened or moved: the "Sibling skills (local only)" section duplicates the "Then also read" routing, the "Minimal checklist" item is a dense paragraph ("Anonymous login is disabled by default... otherwise the gateway returns 401. For apps that require verified login (e.g. admin panels), enforce AuthGuard / RLS...") far beyond "minimal", and conversational framing like "Read this before telling a user to 're-authorize'..." pads tokens. Not a 2 because there is no basic-concept padding and the routing content genuinely earns its place; not a 4 because the tightening needed goes beyond minor trims.

3 / 5

Actionability

Concrete, executable routing is provided: "queryAppAuth / manageAppAuth: app-side authentication configuration. Use them for login methods, provider settings, publishable key, static domain, client config, and custom login keys", a numbered "Preferred execution order" with an explicit fallback rule ("Use callCloudApi only as a fallback or for debugging raw request shapes"), and named auth-tool operations (status, start_auth, set_env, logout, get_temp_credentials). Not a 5 because no example invocations or request shapes appear inline — the executable payloads are deferred to references/extended-guide.md. Not a 3 because the tool-routing guidance itself is specific and directly actionable.

4 / 5

Workflow Clarity

A sequence exists (the "Preferred execution order" steps 1-4 plus the Activation Contract's use-first conditions), but verification checkpoints are only implicit — the gotcha "Writing login UI before enabling the required provider" implies a confirm-before-proceeding step that is never stated as an explicit checkpoint, and there is no re-query-to-confirm loop after a provider change. Not a 2 because the steps that are listed are well defined and coherent; not a 4 because checkpoints are missing rather than merely minor-gapped.

3 / 5

Progressive Disclosure

The body is an overview that correctly defers detail one level deep to a real packaged file ("[extended-guide.md](references/extended-guide.md)"), but navigation is broken by the dangling link "[Authentication Activation Checklist](checklist.md)" — checklist.md is not in the bundle and is absent from the "Reference index" of packaged files — plus the dense anonymous-login and credential-scope passages that belong in the reference file. Not a 2 because the overall structure is genuinely good with clearly signaled one-level-deep references; not a 4 because the missing in-bundle file is a real navigation defect, not a minor organization gap.

3 / 5

Total

13

/

20

Passed

Description

88%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description: it states what the skill does and when to use it with concrete, third-person trigger language covering the provider-configuration domain. The only gaps are missing natural synonyms (e.g. sign-in, third-party login) and residual overlap risk with sibling auth implementation skills.

DimensionReasoningScore

Specificity

The description lists multiple concrete actions — "inspect, enable, disable, or configure auth providers, publishable-key prerequisites, login methods, SMS/email sender setup" — giving comprehensive coverage of the provider-configuration domain. It is not a 4 because the action list covers the domain's core operations (status checks, toggling, key prerequisites, sender setup) without notable gaps.

5 / 5

Completeness

Both halves are explicit: the what ("CloudBase auth provider configuration and login-readiness guide") and the when ("This skill should be used when users need to inspect, enable, disable, or configure... before implementing a client or backend auth flow") with concrete trigger phrases. Not a 4 because the when-clause is fully explicit rather than merely present.

5 / 5

Trigger Term Quality

Natural trigger terms are present — "auth providers", "login methods", "SMS/email sender setup", "publishable key" — that users would plausibly say. It is not a 5 because common synonyms like "sign-in", "log-in", or "third-party login" are missing, keeping keyword coverage short of comprehensive.

4 / 5

Distinctiveness Conflict Risk

The scoping to "provider-side readiness before implementing a client or backend auth flow" clearly separates it from implementation skills. Not a 5 because sibling auth skills in the same plugin cover adjacent auth territory, so a bare "login" or "auth" request carries some overlap risk with those closely related skills.

4 / 5

Total

18

/

20

Passed

Validation

87%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

relative_links

Relative link issues: 1 missing

Warning

Total

14

/

16

Passed

Repository

TencentCloudBase/CloudBase-AI-Toolkit

Path

plugin/cloudbase/skills/auth-tool-cloudbase/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.