CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

nextauth-skill

Set up NextAuth.js v5 (Auth.js) with providers, callbacks (jwt, session, signIn), adapter pattern (Prisma/Drizzle), middleware protection, session management, and custom pages.

Quality

73%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./auth/nextauth-skill/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

65%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A dense, largely executable reference for NextAuth v5 with correct edge-compatible config splitting and concrete code for every layer (config, handler, middleware, pages, env). It reads as a pattern catalog rather than a guided workflow — no ordered setup steps or validation checkpoints — and makes no use of progressive disclosure, keeping everything in one inline file with dangling cross-skill references.

Suggestions

Add an explicit ordered setup workflow (1. install, 2. generate AUTH_SECRET, 3. create auth.config.ts, ...) with validation checkpoints after each stage, e.g. verify the session payload at /api/auth/session before wiring middleware.

Move advanced patterns (custom sign-in/error pages, type augmentation, protected server actions) into reference files (e.g. references/pages.md, references/types.md) and keep SKILL.md as a lean overview with clearly signaled links.

Resolve the dangling cross-skill references: either inline the required Prisma/Drizzle auth schema models or ship them as an actual file in this bundle instead of pointing to external skills that may not exist.

DimensionReasoningScore

Conciseness

The body is code-heavy with terse conventions and almost no explanation of concepts Claude already knows, but the ~75-line styled sign-in page markup (Tailwind classes, divider markup) and the SessionProvider layout boilerplate are trimmable noise for an auth setup skill.

4 / 5

Actionability

Mostly copy-paste-ready guidance: install commands, `npx auth secret`, full auth.config.ts/auth.ts split, route handler, middleware, type augmentation, and .env.local values. Minor gaps remain — `findUserByCredentials` is an unimplemented stub returning null, and the required Prisma auth schema is deferred to a `prisma-schema-starter` skill that is not part of this bundle.

4 / 5

Workflow Clarity

An implicit sequence exists (scaffold → structure → config → route handler → middleware → pages → env vars) via section ordering, but steps are never explicitly sequenced and validation checkpoints are absent or implicit — the only verification is `open http://localhost:3000/api/auth/session` buried in Common Commands, with no guidance on what a working vs. broken result looks like.

3 / 5

Progressive Disclosure

The single 430-line file has clear section headers but no bundle files at all: advanced patterns (custom sign-in page, type augmentation, protected server actions) that belong in reference files are inlined, and the cross-references to `prisma-schema-starter`, `drizzle-starter`, and `jwt-auth-skill` are unresolvable pointers to skills outside this bundle.

3 / 5

Total

14

/

20

Passed

Description

71%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A specific, well-scoped description that names the exact library version and enumerates concrete capabilities with named technologies (Prisma/Drizzle, jwt/session/signIn callbacks). Its main weaknesses are the complete absence of a "when to use" trigger clause and missing common trigger synonyms like "authentication" and "login".

Suggestions

Add an explicit trigger clause, e.g. "Use when setting up authentication/login in a Next.js app, or when the user mentions NextAuth, Auth.js, OAuth providers, or protecting routes."

Include natural user phrasings such as "authentication", "login", and "sign-in" alongside the existing technical terms to improve trigger matching.

Clarify scope boundaries vs. generic token-based auth (e.g. state this is for browser-based Next.js apps, not API token auth) to reduce overlap with a jwt-auth skill.

DimensionReasoningScore

Specificity

The description enumerates multiple concrete capabilities — "providers, callbacks (jwt, session, signIn), adapter pattern (Prisma/Drizzle), middleware protection, session management, and custom pages" — giving comprehensive coverage of the NextAuth setup domain rather than 1-2 generic actions.

5 / 5

Completeness

It clearly answers "what" (set up NextAuth.js v5 with providers, callbacks, adapters, middleware, sessions, custom pages) but contains no "Use when..." clause or equivalent trigger guidance, which caps completeness at 3 per the judging guidelines.

3 / 5

Trigger Term Quality

Good natural keywords are present ("NextAuth.js v5", "Auth.js", "Prisma", "Drizzle", "middleware", "session", "signIn"), but common user phrasings like "authentication", "login", or "OAuth" are missing, so it falls short of the comprehensive synonym coverage of a 5.

4 / 5

Distinctiveness Conflict Risk

"Set up NextAuth.js v5 (Auth.js)" carves out a clear niche with distinct triggers, but generic terms like "jwt" and "session management" create minor overlap risk with closely related auth skills (the body itself defers token-based auth to a separate jwt-auth-skill).

4 / 5

Total

16

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository

achreftlili/deep-dev-skills

Path

auth/nextauth-skill/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.