omni-auth

Manage API key authentication and session tokens. Start here to authenticate requests via Bearer token, obtain session cookies, and configure login requirements for the OmniRoute API.

Quality

58%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/omni-auth/SKILL.md

Quality

Content

57%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is actionable with executable curl examples and a clear setup section, but it mixes generated API docs with a large migrated marketing/link catalog that bloats the body. Workflow clarity and progressive disclosure suffer from missing validation checkpoints for auth flows and inlined content that belongs in separate reference files.

Suggestions

Move the capability/CLI link tables and 'Differentiators vs OpenAI direct' section into a separate references file (e.g. CAPABILITIES.md) and link to it one level deep.

Add explicit validation checkpoints for the OIDC flow (e.g. verify the ID token, check the allowlist, confirm the session cookie) and error-recovery guidance for login/logout.

Trim the duplicated description in the Overview and the marketing copy ('One key, 327 providers...') to improve token efficiency.

Dimension	Reasoning	Score
Conciseness	The body is mostly efficient with executable curl examples and tables, but the migrated 'custom' section repeats the description and inlines a large capability/CLI link catalog plus differentiator marketing copy that pads the token budget.	3 / 5
Actionability	Provides concrete, copy-paste curl commands for each endpoint and a clear setup block with env vars and a health-check command; minor gaps are that login/logout examples send empty bodies and OIDC flows lack full parameter guidance.	4 / 5
Workflow Clarity	Endpoints are listed in a rough sequence but auth flows (especially OIDC login→callback) lack explicit validation checkpoints or error-recovery steps, and the batch/destructive logout has no verification guidance.	3 / 5
Progressive Disclosure	There is section structure and links to per-capability SKILL.md files and an OpenAPI spec, but no bundle files exist and the inlined capability/CLI link tables and differentiators should live in separate reference files rather than the main body.	3 / 5
	Total	13 / 20 Passed

Description

58%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and well-scoped to OmniRoute auth, naming concrete capabilities like Bearer tokens, session cookies, and login configuration. Its main weakness is the absence of an explicit 'Use when...' trigger clause, which limits completeness and trigger-term quality.

Suggestions

Add an explicit 'Use when...' clause, e.g. 'Use when authenticating to the OmniRoute API, managing API keys, or handling session login/logout.'

Include natural synonyms users might say such as 'sign in', 'credentials', and 'auth tokens' to improve trigger-term coverage.

Mention OIDC/login flows in the description since they are a core capability documented in the body.

Dimension	Reasoning	Score
Specificity	Lists several concrete actions ('authenticate requests via Bearer token, obtain session cookies, and configure login requirements') rather than vague language, though coverage is limited to the auth domain.	4 / 5
Completeness	The 'what' is clear (manage auth and tokens), but there is no 'Use when...' clause; 'Start here' weakly implies when to use it without an explicit trigger, which caps completeness at 3.	3 / 5
Trigger Term Quality	Includes relevant terms like 'API key', 'session tokens', 'Bearer token', and 'login', but misses common natural variations and synonyms a user might say (e.g. 'sign in', 'auth', 'credentials').	3 / 5
Distinctiveness Conflict Risk	Scoped to OmniRoute API authentication specifically, giving it a clear niche with minimal overlap risk against other skills; only minor overlap with general API/auth skills.	4 / 5
	Total	14 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: diegosouzapw/OmniRoute
Path: skills/omni-auth/SKILL.md
Commit: ea0cdc5

Reviewed: about 6 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.