CtrlK
BlogDocsLog inGet started
Tessl Logo

omni-api-keys

Create, list, rotate, and revoke OmniRoute API keys. Control per-key scopes, spending limits, and expiration. Keys gate access to all proxy and management endpoints.

65

Quality

77%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No known issues

Fix and improve this skill with Tessl

tessl review fix ./skills/omni-api-keys/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

72%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A concise, well-organized API reference with executable curl examples and good deferral of detail to the OpenAPI spec. It is weakened by stubbed create/update payloads and the absence of verification steps for destructive key operations.

Suggestions

Replace the empty `-d '{}'` bodies on POST/PATCH with a minimal concrete example showing the actual fields (scopes, spending limit, expiration) so the create/update flows are copy-paste complete.

Add a short rotate workflow (create a new key, switch consumers, then revoke the old one) with a verification checkpoint before revocation, since revoke is a destructive operation.

Include a one-line note on how to confirm a key was created/revoked (e.g., re-list keys) to add a feedback loop to the destructive operations.

DimensionReasoningScore

Conciseness

The body is lean: per-endpoint curl snippets with minimal prose and no explanation of concepts Claude already knows; the one explanatory paragraph (masked IPs / device tracker) is directly relevant. It is not the level below because there is no padded or unnecessary explanation, only minor Overview/description redundancy.

3 / 3

Actionability

GET/DELETE curls are executable and copy-paste ready, but POST and PATCH ship empty `-d '{}'` bodies and defer real fields to the external OpenAPI spec, leaving key request details missing. It is not a 3 because the create/update payloads are stubs rather than complete, and not a 1 because real executable commands are present.

2 / 3

Workflow Clarity

Endpoints are listed in a clear structure, but destructive operations (revoke/DELETE) have no verification checkpoint and the implied rotation workflow (create new then revoke old) is never sequenced. It is not a 3 because validation/feedback steps are missing for risky key operations, and not a 1 because the endpoint sequence itself is clear.

2 / 3

Progressive Disclosure

Content is organized into Overview/Authentication/Endpoints/Payloads and defers detailed schemas one level deep to the OpenAPI spec ("GET /api/openapi/spec or docs/openapi.yaml"), with no nested reference chains. It is not the level below because the split is appropriate and navigation is clearly signaled rather than inline-bloated or deeply nested.

3 / 3

Total

10

/

12

Passed

Description

82%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A specific, well-scoped description with concrete actions and natural trigger terms, but it omits any explicit "Use when…" guidance for when to invoke the skill. Adding a trigger clause would raise completeness.

Suggestions

Append a "Use when…" clause (e.g., "Use when managing OmniRoute API keys — creating, rotating, revoking, or adjusting scopes, limits, and expiration.") so both what and when are explicit.

Consider adding common variation phrasings (e.g., "API token", "key rotation") to broaden trigger coverage.

DimensionReasoningScore

Specificity

"Create, list, rotate, and revoke OmniRoute API keys. Control per-key scopes, spending limits, and expiration" lists multiple concrete actions (create, list, rotate, revoke, scope control, limits, expiration) matching the 3-anchor. It is not the level below because it goes well beyond naming a domain plus one or two actions.

3 / 3

Completeness

It clearly answers "what" (the CRUD + control actions) but contains no "Use when…" or equivalent explicit trigger guidance, which caps completeness at 2 per the rubric guidelines. It is not a 3 because the "when" trigger is entirely absent rather than explicit.

2 / 3

Trigger Term Quality

Terms users would naturally say are well covered: "API keys", "rotate", "revoke", "scopes", "spending limits", "expiration". It is not the level below because these are common natural phrasings rather than jargon or a single keyword.

3 / 3

Distinctiveness Conflict Risk

"OmniRoute API keys" is a clear niche with distinct triggers, unlikely to fire for unrelated skills. It is not the level below because the scope (OmniRoute key management) is specific rather than a generic document/code domain.

3 / 3

Total

11

/

12

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
diegosouzapw/OmniRoute
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.