CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

configuration-authentication-cookies

Configure portal cookie names, prefixes, domains, paths, attributes, and refresh overrides. Use for cookie precedence and coordination with authorization token discovery.

Quality

77%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./.codex/skills/configuration-authentication-cookies/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

71%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

This is a dense, highly concrete configuration reference: executable examples throughout, explicit validation commands, and almost no wasted explanation. Its weaknesses are structural — deep implementation detail is inlined in SKILL.md instead of split into reference files, inflating token cost and making navigation harder.

Suggestions

Split deep behavioral detail into references/ files (e.g., sandbox login proof mechanics, placeholder/JSON roundtrip and codec rules, reserved-prefix compatibility), keeping SKILL.md to naming precedence, common Caddyfile examples, and the validation commands.

Add a short numbered workflow tying a configuration change to verification, e.g., edit the Caddyfile → run the quoted go test command → confirm adaptation with the testcase_authenticate_with_cookie_parser fixtures.

Rewrite the most telegraphic passages (e.g., the Placeholders and JSON section) as short bullet rules so they can be scanned without re-reading.

DimensionReasoningScore

Conciseness

Nearly every sentence carries project-specific facts with no padding of concepts Claude already knows, but the ~355-line body inlines deep behavioral detail (sandbox login proof mechanics, CSV/JSON roundtrip and whitespace rules) that belongs in reference files, and some telegraphic passages require re-reading. It is mostly efficient but could be tightened and partially relocated, matching anchor 3 rather than anchor 4's "minor instances of over-explanation".

3 / 5

Actionability

The body provides copy-paste-ready Caddyfile blocks covering the common cases (prefix-only portal, explicit names, attribute/domain scopes, __Host-/__Secure- combinations, gatekeeper policies) plus an exact runnable "go test -mod=readonly -race -count=1 -run 'TestPortalCookie|...'" command with named fixtures. This fully matches anchor 5: executable, specific examples covering the common cases.

5 / 5

Workflow Clarity

Sections progress coherently from naming/precedence through attributes and placeholders to policy coordination, ending in an explicit Validation section with runnable test commands and named testdata fixtures. It matches anchor 4 rather than 5 because the configure-then-validate loop is implicit in section order rather than an explicit sequenced workflow with feedback steps.

4 / 5

Progressive Disclosure

Section headers are clear and cross-links to sibling skills are well signaled, but the skill ships no bundle of its own — hundreds of lines of deep detail (sandbox proof behavior, encoding/roundtrip rules, reserved-prefix compatibility) are inlined monolithically in SKILL.md. This matches anchor 3 (content that should be separate is inline) rather than anchor 4's "most content appropriately placed".

3 / 5

Total

15

/

20

Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is concrete, covers the full cookie-configuration surface, and includes an explicit trigger clause — a solid all-around 4 on every dimension. Its main weakness is that the when-clause is phrased abstractly (precedence, coordination) rather than with concrete trigger phrases a user would naturally say.

Suggestions

Make the trigger clause more concrete, e.g., "Use when setting or renaming authentication portal cookies, choosing cookie prefixes, scoping cookie domains/paths, or aligning policy token sources with portal cookie names."

Add one or two natural vocabulary items users would type, such as "session cookie", "cookie attributes (Secure, HttpOnly, SameSite)", or "portal cookie", to broaden trigger matching.

DimensionReasoningScore

Specificity

"Configure portal cookie names, prefixes, domains, paths, attributes, and refresh overrides" enumerates six concrete configuration surfaces, giving several specific actions with only minor gaps. It falls short of anchor 5 because a single verb carries the list and capabilities like validation and collision checking are only implied by the second sentence.

4 / 5

Completeness

It answers both "what" (configure names, prefixes, domains, paths, attributes, refresh overrides) and "when" via the explicit "Use for cookie precedence and coordination with authorization token discovery" clause. The when-clause is present but abstract, so it matches anchor 4 rather than anchor 5's concrete trigger phrases.

4 / 5

Trigger Term Quality

Natural terms users would say are present ("cookie", "prefixes", "domains", "paths", "refresh", "cookie precedence"), but a few common variations are missing (e.g., "session cookie", "SameSite/Secure/HttpOnly", "authentication portal"). This matches anchor 4 (good keyword coverage, a few natural terms missing) rather than anchor 5's comprehensive synonym coverage.

4 / 5

Distinctiveness Conflict Risk

"Portal cookie" carve-out is a clear niche with specific triggers, but "coordination with authorization token discovery" overlaps the territory of closely related sibling skills (configuration-authentication, configuration-authorization). This matches anchor 4 (mostly distinct, minor overlap risk with closely related skills) rather than anchor 5's minimal conflict risk.

4 / 5

Total

16

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

relative_links

Relative link issues: 5 suspicious

Warning

Total

15

/

16

Passed

Repository

greenpau/caddy-security

Path

.codex/skills/configuration-authentication-cookies/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.