CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

auth-web-cloudbase

CloudBase Web Authentication Quick Guide for frontend integration after auth-tool has already been checked. Provides concise and practical Web authentication solutions with multiple login methods and complete user management.

59

Quality

74%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./plugin/cloudbase/skills/auth-web-cloudbase/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

81%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a highly actionable, well-sequenced frontend auth guide: copy-paste v3 SDK code for every common flow, mandatory MCP pre-checks with exact tool actions, error-signature-driven recovery guidance, and a completion checklist. Its main weaknesses are token efficiency — the same three critical warnings are each repeated 3-4 times across sections — and a SKILL.md that carries detail which could be consolidated into the existing one-level-deep extended guide.

Suggestions

Deduplicate the three repeated warnings (getLoginState vs getSession, accessKey ≠ session, verifyOtp callback form): state each once in the gotchas section and reference it from elsewhere instead of restating full paragraphs in the parameter map, Quick Start comments, and cookbook.

Merge the two 'Prerequisites' statements (lines 58-59 under Overview and the later '## Prerequisites' section) into one section.

Collapse the 'Extended guide' and 'Reference index' sections into a single reference section, and consider moving the long 'Common mistakes' detail list into references/extended-guide.md to keep SKILL.md closer to an overview.

DimensionReasoningScore

Conciseness

The body is dense with skill-specific gotchas and explains nothing Claude already knows, but the same three critical warnings are repeated 3-4 times each: the misleading getLoginState()/getSession() uid issue (gotchas, parameter map, Quick Start comment), accessKey-not-a-session (gotchas, parameter map, init comment, cookbook), and the verifyOtp callback form (gotchas, Supabase differences, parameter map, cookbook). Prerequisites are also stated twice (lines 58-59 and the '## Prerequisites' section). This matches anchor 3 (mostly efficient but could be tightened); not 2 because there is no padding or filler — only duplicated high-value warnings — and not 4 because the duplication is substantial rather than minor.

3 / 5

Actionability

The cookbook provides copy-paste-ready, executable code for every common case — signInWithPassword, signUp + data.verifyOtp, signInWithOtp, resetPasswordForEmail + updateUser, getSession guard, onAuthStateChange, signOut — plus exact MCP calls with action parameters (queryAppAuth(action="listProviders"), manageAppAuth(action="ensurePublishableKey")) and specific error signatures to branch on ('messageId is required', gateway 401). This matches anchor 5: fully executable examples covering the common cases; not 4 because no significant gaps remain in the main flows.

5 / 5

Workflow Clarity

The sequence is explicit and enforced: verify auth-tool provider setup first ('Do not start here first when... provider configuration has not been verified'), obtain and persist the publishable key, init the SDK, implement via the cookbook, then validate against the 'Completion Bar' checklist before declaring done. Error-recovery feedback loops are spelled out with concrete signatures (e.g. seeing 'messageId is required' means the callback form was skipped; empty publishable key → ensurePublishableKey first). This matches anchor 5 — explicit validation steps, feedback loops, and a checklist.

5 / 5

Progressive Disclosure

Structure is good: a real one-level-deep bundle reference (references/extended-guide.md, 401 lines, exists, no nested references) is clearly signaled from both the 'Extended guide' and 'Reference index' sections, and sibling-skill paths are handled with an explicit missing-file fallback. Not anchor 5 because SKILL.md itself is a 229-line dense guide rather than a lean overview — the long 'Common mistakes' list and some duplicated parameter-map detail could live in the extended guide — and the reference link is duplicated across two sections. It stays above anchor 3 because the split that exists (login-method details in the reference) is appropriate and navigation is easy.

4 / 5

Total

17

/

20

Passed

Description

57%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description establishes a clear, distinct niche (CloudBase Web auth, sequenced after auth-tool) but reads as a summary label rather than an activation trigger. It lacks a 'Use when...' clause with natural trigger phrases and uses generic phrasing ('concise and practical solutions', 'complete user management') instead of naming concrete capabilities like password sign-in, OTP login, or session/route-guard management.

Suggestions

Add an explicit trigger clause naming natural user phrasings, e.g. 'Use when the user asks for a web login page, sign-in/sign-up flow, session handling, or protected routes built with @cloudbase/js-sdk'.

Replace generic phrasing ('concise and practical Web authentication solutions', 'complete user management') with concrete capabilities: password sign-in, email/phone OTP login, OAuth, session checks, and auth-gated routes.

Include the SDK name '@cloudbase/js-sdk' and common synonyms ('login', 'sign in', 'register') to improve trigger-term coverage.

DimensionReasoningScore

Specificity

The description names the domain ('CloudBase Web Authentication') and gestures at two action areas ('multiple login methods and complete user management'), but phrases like 'concise and practical Web authentication solutions' are generic marketing-style language with no named concrete operations (no sign-in, OTP, session, or route-guard actions). This matches anchor 3 (domain plus 1-2 concrete actions, not comprehensive) — not 4, since no specific API-level actions are listed; not 2, since it does go beyond bare domain naming.

3 / 5

Completeness

The 'what' is stated ('Provides... Web authentication solutions with multiple login methods and complete user management'), but there is no 'Use when...' or equivalent user-facing trigger clause — 'after auth-tool has already been checked' is a sequencing precondition between sibling skills, not guidance on when a user request should activate this skill. Per the judging guideline, a missing explicit trigger clause caps completeness at 3 ('what' clear, 'when' only weakly implied).

3 / 5

Trigger Term Quality

Relevant keywords exist ('CloudBase', 'Web Authentication', 'login methods', 'user management'), but common natural phrasings users would actually say are missing: 'sign in', 'login page', 'register', 'sign up', 'session', 'OTP', '@cloudbase/js-sdk'. This matches anchor 3 (some relevant keywords, missing common variations); not 4 because several high-frequency natural terms are absent.

3 / 5

Distinctiveness Conflict Risk

'CloudBase Web Authentication' is a clear niche with distinct technology-specific triggers, and 'for frontend integration after auth-tool has already been checked' explicitly positions it against its closest sibling skill. Conflict risk is minimal — only the deliberately-scoped sibling overlap remains. Matches anchor 5; not 4 because the one risky overlap (auth-tool-cloudbase) is explicitly disambiguated in the description itself.

5 / 5

Total

14

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository

TencentCloudBase/CloudBase-AI-Toolkit

Path

plugin/cloudbase/skills/auth-web-cloudbase/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.