CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

setup-flows-auth

MUST be used when migrating an existing React app to Flows, or when no Flows auth is wired up. Detects classic vs Apps API flow from `app.json` `infra` field, installs the right packages, and wires up the entry file. No-op when a valid auth setup is already in place. Triggers: migrate to Flows, add Flows auth, DuneAuthProvider, AppSdkAuthProvider, connectToHostApp, useDune, Flows setup, setup auth, missing auth provider, CDF authentication, Fusion iframe auth.

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

82%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-structured procedure: copy-paste-ready code for both flows, package tables, package-manager detection, a no-op pre-check, and a conservatively guarded cleanup step. The main gaps are token efficiency (repeated boilerplate between the two entry-file examples and unsectioned version pins) and the absence of a final verification step after wiring.

Suggestions

Collapse the two `main.tsx` examples: describe the Apps API variant as 'identical to the Classic `main.tsx` but without `<DuneAuthProvider>`' and show only the single differing JSX block, saving ~20 lines of repeated boilerplate.

Add a final verification step (e.g. 'start the dev server with the detected package manager and confirm `fusionOpenPlugin` opens the app inside Fusion with the authenticated client resolving') to close the workflow with a validation checkpoint.

Isolate version-sensitive details like `@cognite/app-sdk >= 0.5.1` into a single 'Version requirements' or 'Notes' line instead of restating them inline in both Step 1 and Step 4, making future version bumps a one-line edit.

DimensionReasoningScore

Conciseness

The body is lean — decision tables, full code blocks, and one-line rationales ('base: "./" — required for Fusion iframe deployment') with no padding or explanation of concepts Claude already knows. It misses anchor 5 because the second `main.tsx` example repeats the classic-flow boilerplate nearly verbatim (could be 'same as Classic minus DuneAuthProvider'), and bare version pins ('@cognite/app-sdk >= 0.5.1', stated twice) are time-sensitive details not isolated in a versions/deprecated section.

4 / 5

Actionability

Everything is executable: complete copy-paste-ready `main.tsx`/`App.tsx`/`vite.config.ts` blocks, package tables split runtime vs dev with the exact install commands per detected package manager ('pnpm add', 'npm install', 'yarn add', '-D / --save-dev'), and precise ordering constraints ('manifestCspPlugin() must be first').

5 / 5

Workflow Clarity

Steps 1–5 are clearly sequenced, and Step 1 is a real pre-flight checkpoint (detect an existing valid setup → no-op) with Step 5 guarded by 'If unsure, leave it and flag to the user' — appropriately cautious for a step that deletes code. It falls short of anchor 5 because there is no post-change validation (e.g. run the dev server / confirm the Fusion handshake) or error-recovery loop after wiring.

4 / 5

Progressive Disclosure

The body is well-sectioned per step and per flow, and there are no broken or nested references (no bundle files exist, and none are linked). It does not reach anchor 5 because at ~185 lines covering two distinct flows, the per-flow code and vite details are prime candidates for a one-level-deep reference file rather than the under-50-line single-file case the exception rewards.

4 / 5

Total

17

/

20

Passed

Description

91%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description that states concrete capabilities, an explicit MUST-use trigger condition, third-person voice, and a comprehensive trigger list spanning natural phrases and exact API names. The only weaknesses are mildly generic phrasing in the capability list and a couple of broad trigger terms that create minor conflict risk.

DimensionReasoningScore

Specificity

Names several concrete actions — 'Detects classic vs Apps API flow from `app.json` `infra` field, installs the right packages, and wires up the entry file' — plus the no-op behavior. It falls short of anchor 5 because 'installs the right packages' and 'wires up the entry file' stay slightly generic relative to the five-action coverage of the top anchor, but it clearly exceeds anchor 3's '1-2 concrete actions'.

4 / 5

Completeness

It explicitly answers both questions: 'what' via 'Detects... installs... wires up the entry file' and 'when' via 'MUST be used when migrating an existing React app to Flows, or when no Flows auth is wired up', followed by concrete trigger phrases. Voice is third person ('Detects', 'installs'), so no voice penalty applies.

5 / 5

Trigger Term Quality

The trigger list covers both natural phrases users would say ('migrate to Flows', 'Flows setup', 'setup auth', 'missing auth provider') and the exact code identifiers they might paste ('DuneAuthProvider', 'connectToHostApp', 'useDune', 'CDF authentication', 'Fusion iframe auth'), matching the comprehensive-with-synonyms anchor.

5 / 5

Distinctiveness Conflict Risk

The Flows/CDF/Fusion niche is clear and the API identifiers (DuneAuthProvider, connectToHostApp) are distinctive, but generic trigger phrases like 'setup auth' could plausibly overlap with unrelated auth-configuration skills, keeping it at anchor 4 rather than 5.

4 / 5

Total

18

/

20

Passed

Validation

87%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

allowed_tools_field

'allowed-tools' contains unusual tool name(s)

Warning

metadata_version

'metadata.version' is missing

Warning

Total

14

/

16

Passed

Repository

cognitedata/builder-skills

Path

skills/setup-flows-auth/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.