CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

auth-implementation-patterns

Build secure, scalable authentication and authorization systems using industry-standard patterns and modern best practices.

Quality

56%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./plugins/AI-Agents-Safe-Coding-Skills/skills/auth-implementation-patterns/SKILL.md

The canonical home for this skill is auth-implementation-patterns in rmyndharis/antigravity-skills

SKILL.md
Quality
Evals
Security

Quality

Content

50%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is concise and well-structured with sensible use/don't-use boundaries and a safety section, but it delivers almost no executable guidance — every concrete detail is outsourced to a playbook file that is missing from the bundle. The structure is sound; the substance and the single external reference are the weak points.

Suggestions

Fix the broken bundle reference: either add `resources/implementation-playbook.md` (with the concrete patterns and examples the Instructions promise) or remove the pointer and inline the essential guidance; also use the conventional `references/` directory name.

Add at least a few concrete anchors to the Instructions (e.g. named token-lifecycle parameters, a minimal session/JWT configuration snippet, or specific library/tool recommendations) so the skill is actionable without the missing playbook.

Add validation checkpoints to the workflow (e.g. "verify token expiry/rotation behavior before deploying", "confirm least-privilege policies with a test request per role") to move from a bare sequence to a checkpointed process.

DimensionReasoningScore

Conciseness

The body is lean (~40 lines), well under budget, and explains nothing Claude already knows. It is not a 5 because of minor redundancy: the frontmatter description is repeated verbatim under the H1, and the playbook pointer appears in both Instructions ("If detailed examples are required, open `resources/implementation-playbook.md`") and the Resources section.

4 / 5

Actionability

Instructions are high-level planning directives ("Define users, tenants, flows, and threat model constraints", "Choose auth strategy (session, JWT, OIDC)") with no code, commands, or specific patterns, and all concrete detail is deferred to a playbook file that does not exist in the bundle. This matches anchor 2 ("Minimal concrete guidance; high-level hints but missing the specific steps to execute") rather than 3, which would require some concrete, executable guidance.

2 / 5

Workflow Clarity

The five instruction bullets form a coherent design sequence (define constraints -> choose strategy/token lifecycle -> design authorization -> plan secrets/audit), but there are no validation checkpoints or feedback loops anywhere. This matches anchor 3 ("Steps listed but validation gaps; sequence present but checkpoints missing or implicit") rather than 4, which requires most checkpoints to be present.

3 / 5

Progressive Disclosure

Sections (Use when / Do not use when / Instructions / Safety / Resources) are well organized and appropriately light, but the sole external reference, `resources/implementation-playbook.md`, is dangling: no `resources/` (or `references/`, `scripts/`, `assets/`) directory exists in the bundle, so the one navigation pointer given fails. This caps the dimension at 3 rather than 4, since a broken reference is worse than "references mostly clear".

3 / 5

Total

12

/

20

Passed

Description

45%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description communicates the domain clearly but is buzzword-heavy and lacks any trigger guidance. It reads as a generic capability statement rather than a scoped, trigger-rich description in the style of the good examples. Adding a 'Use when' clause with concrete trigger terms would address the two biggest gaps (completeness and trigger quality).

Suggestions

Add a 'Use when...' clause with concrete triggers, e.g. "Use when implementing login, OAuth2/social login, SSO, session management, RBAC, or securing REST/GraphQL APIs, or when debugging auth issues."

Replace buzzword padding ("secure, scalable", "industry-standard", "modern best practices") with 2-3 concrete capabilities, e.g. "Implements session vs JWT vs OIDC strategies, token lifecycle, RBAC policy enforcement, and secrets rotation."

Include natural synonyms users actually type ("login", "auth", "SSO", "OAuth", "JWT") to improve trigger matching and distinctiveness from generic security skills.

DimensionReasoningScore

Specificity

The description names the domain ("authentication and authorization systems") but the only action is a generic "Build" padded with buzzwords ("secure, scalable", "industry-standard patterns and modern best practices") and no concrete sub-actions. It matches anchor 2 ("Names the domain but actions are minimal or generic") rather than 3, which would require 1-2 concrete actions such as OAuth flows, session management, or RBAC design.

2 / 5

Completeness

A clear "what" is present ("Build secure, scalable authentication and authorization systems") but there is no "when" clause at all. This matches anchor 3 ("Has a clear 'what' but 'when' is missing or only weakly implied"), and the judging guideline explicitly caps completeness at 3 for a missing 'Use when...' clause.

3 / 5

Trigger Term Quality

"authentication" and "authorization" are natural terms users would say, but common variations and synonyms ("login", "auth", "SSO", "OAuth", "JWT", "session management") are all missing. This matches anchor 3 ("Some relevant keywords but missing common variations or synonyms") rather than 4, since effective coverage is only two terms.

3 / 5

Distinctiveness Conflict Risk

The auth/authz domain is a genuine niche, but the generic phrasing and absence of concrete triggers means it could overlap with general security, API-hardening, or infrastructure skills. This sits at anchor 3 ("Somewhat specific but could still overlap with similar skills"), not 4, which would require distinct concrete triggers.

3 / 5

Total

11

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository

administrakt0r/AI-Agents-Safe-Coding-Skills

Path

plugins/AI-Agents-Safe-Coding-Skills/skills/auth-implementation-patterns/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.