CtrlK
BlogDocsLog inGet started
Tessl Logo

omni-api-keys

Create, list, rotate, and revoke OmniRoute API keys. Control per-key scopes, spending limits, and expiration. Keys gate access to all proxy and management endpoints.

53

Quality

58%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/omni-api-keys/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

58%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is a clean, mostly executable endpoint reference with good conciseness and concrete curl examples, but it functions as a flat API listing rather than a workflow: destructive and batch operations lack validation steps or feedback loops, and the large endpoint catalog is inlined rather than progressively disclosed into a separate reference file.

Suggestions

Add validation/verification checkpoints for destructive and batch operations — e.g. 'After DELETE, confirm with GET /api/keys that the key is gone; verify regenerate took effect by checking usage-limits.'

Move the bulk endpoint catalog into a separate references file (e.g. references/endpoints.md) and keep SKILL.md as an overview with one-level-deep, clearly signaled links, raising the progressive_disclosure score.

Replace placeholder headings like 'POST keys › <id> › regenerate' and empty '-d {}' bodies with a brief action description and a representative JSON payload so examples are directly executable.

DimensionReasoningScore

Conciseness

The body is largely efficient — terse endpoint headers with copy-paste curl examples and almost no concept explanation — but the repeated near-identical curl blocks across ~20 endpoints and placeholder headings like 'POST keys › <id> › regenerate' introduce redundancy that could be trimmed.

4 / 5

Actionability

Each endpoint ships a concrete, executable curl example with the real host, port, and auth header, which is mostly copy-paste ready; the gaps are empty JSON bodies ('-d {}') and parameter placeholders ({id}) that the user must fill in without guidance.

4 / 5

Workflow Clarity

The skill documents destructive and batch operations (DELETE keys, DELETE groups/{id}/keys, regenerate) but provides no validation/verification steps, no error-handling or feedback loops, and no sequencing guidance beyond the endpoint listing; the rubric's destructive-operation cap and absent checkpoints pull this well below the midpoint.

2 / 5

Progressive Disclosure

Structure exists (Overview, Authentication, Endpoints, Payloads) and it points to the OpenAPI spec for detailed schemas, but the bulk API reference is inlined in SKILL.md rather than split into a separate reference file, and the 'See the full OpenAPI specification' pointer is not a cleanly signaled one-level reference to a bundled file.

3 / 5

Total

13

/

20

Passed

Description

58%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and clearly conveys what the skill does with concrete API-key lifecycle actions, but it lacks an explicit 'Use when...' trigger clause, which caps completeness at 3 and leaves the 'when to use' question unanswered. Trigger term coverage is decent but missing natural user phrasings and synonyms.

Suggestions

Append an explicit 'Use when...' clause naming the natural trigger phrases a user would say, e.g. 'Use when managing or troubleshooting OmniRoute API keys, rotating compromised keys, or adjusting per-key scopes and spending limits.'

Add common-synonym trigger terms users actually say ('API key management', 'rotating keys', 'key scopes', 'spending caps') to broaden natural keyword coverage.

Clarify the scope boundary (e.g. 'proxy and management endpoint access') earlier so it is distinguishable from a generic auth-management skill.

DimensionReasoningScore

Specificity

Names the domain (OmniRoute API keys) and lists several concrete actions — 'Create, list, rotate, and revoke', 'Control per-key scopes, spending limits, and expiration' — with only minor gaps in coverage such as device tracking and key groups.

4 / 5

Completeness

It clearly answers 'what does this do' with concrete capabilities, but the 'when should Claude use it' guidance is entirely absent — there is no 'Use when...' clause or equivalent trigger, which per the guidelines caps completeness at 3.

3 / 5

Trigger Term Quality

Relevant domain keywords ('API keys', 'rotate', 'revoke', 'scopes', 'spending limits', 'expiration') are present, but it lacks common natural variations or synonyms a user would actually say, and omits any explicit 'Use when...' trigger phrasing.

3 / 5

Distinctiveness Conflict Risk

It targets a specific, named product surface (OmniRoute API keys) with niche-specific triggers (rotate, revoke, per-key scopes, spending limits), making it mostly distinct with only minor overlap risk against a sibling 'authentication' or 'usage' skill.

4 / 5

Total

14

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
diegosouzapw/OmniRoute
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.