CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

omni-auth

Manage API key authentication and session tokens. Start here to authenticate requests via Bearer token, obtain session cookies, and configure login requirements for the OmniRoute API.

Quality

66%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/omni-auth/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

50%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The endpoint documentation core is genuinely actionable with executable curl examples, but the body is padded with a duplicated overview, filler placeholders, and a large off-topic migrated marketing section. Reorganizing around the auth workflow and cutting the gateway boilerplate would materially improve it.

Suggestions

Remove the duplicated Overview text and the "GET auth › csrf" / "GET auth › status" placeholder lines, replacing them with one-line descriptions of what each returns.

Cut or move the migrated OmniRoute gateway section (setup, model discovery, capability tables, differentiators) into a separate reference file, keeping SKILL.md focused on authentication.

Add an explicit sequenced workflow (login → verify status → use cookie → CSRF for state-changing calls → logout) with a validation checkpoint such as checking /api/auth/status after login.

DimensionReasoningScore

Conciseness

Noticeably verbose: the Overview duplicates the description verbatim, placeholder filler like "GET auth › csrf" adds nothing, and ~60 lines of migrated gateway marketing ("375 providers", "20-40% token reduction", "the only AI router that exposes both protocols") are off-topic for an auth skill and include version/number claims outside any deprecated section. Not a 1 because the endpoint examples themselves are lean and free of concept re-teaching.

2 / 5

Actionability

Mostly executable: complete curl commands with cookie jar (-c cookie.jar), a chained CSRF-token fetch for logout, env-var setup, and a health verification call. Not a 5 because the OIDC callback example omits required state/code parameters, making it non-executable as written.

4 / 5

Workflow Clarity

Endpoints are documented individually but the sequence (login → cookie → CSRF → logout; key setup → health check) is only implicit, with just one explicit verification step and implicit recovery via the 401 hint. Not a 4 because no explicit checkpoints connect the steps into a coherent workflow.

3 / 5

Progressive Disclosure

Sections are headed and the OpenAPI spec and capability skills are referenced one level deep, but no bundle files exist while the migrated gateway overview and capability URL tables are inlined content that belongs in separate reference files. Not a 4 because substantial off-scope content is inline rather than split out.

3 / 5

Total

12

/

20

Passed

Description

66%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A solid, third-person description with concrete actions and a named domain, weakened by the absence of an explicit "Use when..." trigger clause and incomplete coverage of the auth flows the skill actually contains. It would rarely trigger for the wrong skill but is not maximally discoverable either.

Suggestions

Add an explicit trigger clause, e.g. "Use when authenticating to OmniRoute, handling 401 errors, managing API keys, or setting up dashboard/OIDC login."

Mention the additional documented flows (logout, CSRF, OIDC/SSO login, auth status) to make capability coverage comprehensive.

Include common user synonyms such as "sign in" and "auth" to broaden natural keyword coverage.

DimensionReasoningScore

Specificity

Names several concrete actions ("authenticate requests via Bearer token", "obtain session cookies", "configure login requirements") anchored to a specific API. Not a 5 because coverage omits logout, CSRF, and OIDC flows that the skill body actually documents.

4 / 5

Completeness

The "what" is clearly stated (manage API key auth and session tokens via Bearer/cookies), but the "when" is only weakly implied by "Start here to authenticate requests" with no explicit "Use when..." trigger clause, capping this dimension at 3.

3 / 5

Trigger Term Quality

Contains natural user-facing terms like "API key", "Bearer token", "session cookies", and "login" that a user would plausibly say. Not a 5 because common variations such as "sign in", "auth", or "token" are missing.

4 / 5

Distinctiveness Conflict Risk

"OmniRoute API" pins a clear niche with specific auth mechanisms, making it mostly distinct. Not a 5 because it could still overlap with sibling OmniRoute skills (inference, MCP) in the same suite.

4 / 5

Total

15

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

diegosouzapw/OmniRoute

Path

skills/omni-auth/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.