CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

credentials

Centralized API key management from Access.txt

48

Quality

61%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

High

Do not use without reviewing

Fix and improve this skill with Tessl

tessl review fix ./skills/credentials/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

56%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with executable parsing code, validation commands, and a clear sequenced setup workflow, but it is padded with redundant duplicate-language implementations, repeated prompt templates, and inlined reference material that should be split into bundle files. Trimming duplication and moving the service reference material to separate files would substantially improve token efficiency.

Suggestions

Keep only one reference parsing implementation (or move the second language variant plus the full pattern table into a references/ file) to eliminate the duplicated logic.

Split the service pattern table, per-service validation commands, and service-specific setup guides into reference files, keeping SKILL.md as a concise workflow overview with clearly signaled links.

Drop the redundant closing "Prompt Template" and "Quick Reference" sections, which repeat Step 1's prompt and the table's env var names.

DimensionReasoningScore

Conciseness

The ~350-line body duplicates the same parsing logic in full Python and TypeScript implementations, restates the regex patterns from the key-identification table inside the code, repeats a near-identical prompt template (Step 1 vs the closing "Prompt Template"), and re-lists env var names in a "Quick Reference" already covered by the table — noticeably verbose with several padded/redundant sections, below the "mostly efficient" midpoint.

2 / 5

Actionability

Provides copy-paste-ready parsing code, executable curl validation commands per service, and concrete bash for .env creation and .gitignore updates; minor gaps keep it from 5 — the pattern table lists Vercel, Twilio, SendGrid, AWS, and Supabase JWT handling that the parsing code does not actually implement.

4 / 5

Workflow Clarity

The 5-step Project Setup Workflow is clearly sequenced with an explicit validation checkpoint (Step 3) and missing-key reporting (Step 5), and validation commands exist for the risky step of using keys; it falls short of 5 because there is no fix-and-retry error-recovery loop (e.g. what to do when validation returns 401).

4 / 5

Progressive Disclosure

Sections are well-organized with clear headers, but with no bundle files the entire bulk reference material — the 17-row service pattern table, per-service validation commands, and service-specific setup guides — is inlined in SKILL.md where it belongs in separate reference files, matching the anchor for content that should be separate being inline.

3 / 5

Total

13

/

20

Passed

Description

48%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description identifies a clear, distinct niche but is thin: it states a generic "what" with no concrete actions and omits any "use when" trigger guidance, relying on a separate when-to-use field that the description itself does not surface. It reads as a title rather than a capability statement.

Suggestions

Add explicit concrete actions to the description, e.g. "Parses API keys from a centralized Access.txt file, validates them via provider APIs, and writes a project .env".

Include a "Use when..." clause in the description itself (e.g. "Use when setting up a project that needs API keys, credentials, or environment variables") rather than relying solely on the when-to-use field.

Add natural synonyms users would say — "credentials", "secrets", "API keys", ".env" — to improve trigger term coverage.

DimensionReasoningScore

Specificity

"Centralized API key management from Access.txt" names the domain and source file, but "management" is a generic action with no concrete verbs (load, parse, validate, write .env) — matching the anchor for domain named with minimal/generic actions rather than 1-2 concrete actions.

2 / 5

Completeness

The description gives a clear "what" (centralized API key management from Access.txt) but contains no "Use when..." clause or equivalent trigger guidance, which caps completeness at 3; it is not 4 because the "when" is entirely absent from the description rather than merely imprecise.

3 / 5

Trigger Term Quality

"API key" is a natural term users would say, but the description misses common variations and synonyms such as "credentials", "secrets", "tokens", or ".env", fitting the anchor for some relevant keywords with missing variations.

3 / 5

Distinctiveness Conflict Risk

The niche (loading keys from a centralized Access.txt file) is fairly distinct with service-specific patterns, with only minor overlap risk against generic environment-variable or project-setup skills; it lacks the explicit trigger phrases of a 5.

4 / 5

Total

12

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository

alinaqi/maggy

Path

skills/credentials/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.