Content
63%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A highly actionable skill body with executable code covering both Node.js and Python variants and sound security conventions (PKCE, state validation, httpOnly cookies). Its main weaknesses are inlined bulk that should live in reference files, duplicated provider callback code, and the absence of an explicit ordered workflow with validation checkpoints.
Suggestions
Move the full controller code, user-linking service, and Python variant into references/ files (e.g., references/controller.md, references/python.md), keeping SKILL.md as an overview with clearly signaled links.
Factor the near-identical Google and GitHub callback handlers into a single shared handler parameterized by provider config to cut ~50 duplicated lines.
Add a short ordered workflow section (redirect -> validate state -> exchange tokens -> link user -> issue session) with an explicit verification step for testing the completed flow.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | Mostly efficient with tight comments, but there is noticeable slack: the frontmatter description is restated as an opening blockquote, the prerequisites duplicate the frontmatter compatibility field, and the Google and GitHub callback handlers are near-identical ~50-line duplicates that could be factored. | 3 / 5 |
Actionability | Concrete, mostly executable guidance: complete provider configs, PKCE helpers, token exchange, scaffold commands, and env-var setup. Minor gaps: 'findOAuthAccount', 'createUser', and 'generateTokenPair' are unimplemented stubs, and the session middleware (lib/session.ts) referenced by req.session is never shown. | 4 / 5 |
Workflow Clarity | The sequence is clear via Key Conventions plus the controller code, with an explicit state-validation checkpoint and error-redirect handling. Minor gaps: no ordered step-by-step workflow section, and no verification step for the issued tokens (e.g., testing the session). | 4 / 5 |
Progressive Disclosure | Sections are well-organized with clear headers, but roughly 300 lines of provider configs, controllers, and a user-linking service are inlined directly in SKILL.md with no reference files in the bundle; this content clearly belongs in separate one-level-deep reference files. | 3 / 5 |
Total | 14 / 20 Passed |