CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

configuration-authentication-cross-device

Configure and verify optional cross-device portal login, QR activation, explicit approval, browser binding, cancellation, and lifecycle through Caddy. Native login and external provider configuration retain their own owners.

Quality

75%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./.codex/skills/configuration-authentication-cross-device/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

71%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A dense, expert-level contract document that is highly specific, free of filler, and strong on validation via a detailed test inventory and executable commands. Its main structural weakness is that all contract detail lives inline in SKILL.md with no progressive disclosure into reference files, and a few sentences trade clarity for compression.

Suggestions

Move stable contract detail (the route table, cookie/security semantics, lifecycle rules) into a reference file (e.g. references/contract.md) and keep SKILL.md as configuration quick-start plus navigation, matching the sibling-skill pattern already linked.

Show the `localdb` identity-store declaration and the `authenticate with myportal` mount together as one complete runnable example instead of describing the missing pieces in prose.

Relax the most compressed sentences (e.g. refresh-family rotation, requester-secret separation) with a short clarifying clause each so a single read conveys the constraint.

DimensionReasoningScore

Conciseness

Nearly every sentence carries a non-obvious domain constraint ("Oversize is 413, unsupported media is 415", "limited to 1024 per portal and eight per trusted source IP") with no padding or explanation of concepts Claude already knows. Not 5 because a few passages are compressed to the point of needing rereading ("Rotation of a live approver refresh family remains valid") and some detail (AbortController API constraints) could be trimmed.

4 / 5

Actionability

Provides complete executable Caddyfile blocks, a copy-paste `make test TEST='^TestPortalCrossDevice|^TestCaddyCrossDeviceE2E'` command, a concrete path/method/behavior table, and named test functions. Not 5 because key setup detail is referenced but not shown ("Declare `localdb` separately" without an example) and most guidance is guardrail-style rather than a complete end-to-end recipe.

4 / 5

Workflow Clarity

Clear topical progression (configuration → routing/browser contract → identity/lifecycle → acceptance) culminating in an explicit test-selection procedure with a concrete command and per-change guidance. Not 5 because the sequence is implicit rather than numbered and there is no validate-fix-retry loop spelled out; not 3 because validation checkpoints are prominently and concretely specified.

4 / 5

Progressive Disclosure

Headers, a route table, and two clearly signaled one-level-deep links to sibling skills give reasonable structure, but the entire ~175-line contract (endpoint semantics, cookie attributes, lifecycle rules, test inventory) is inlined in SKILL.md with no bundle files at all. This matches anchor 3 — content that could live in separate reference files is inline.

3 / 5

Total

15

/

20

Passed

Description

70%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A specific, well-bounded description of a niche feature with concrete action verbs and explicit ownership boundaries. Its main weakness is the complete absence of "Use when..." trigger guidance, which both caps completeness and limits how naturally a user or Claude would discover it.

Suggestions

Add a "Use when..." clause naming concrete triggers, e.g. "Use when configuring, changing, or testing cross-device portal login, QR activation, approval flows, or transfer-session behavior in a Caddy authentication portal."

Include common user phrasings as trigger terms — "QR code login", "second device", "transfer session" — alongside the current terminology.

Mention the validation/test-selection role (a large part of the body) so the "what" covers verifying changes, not just configuring them.

DimensionReasoningScore

Specificity

The description lists several concrete actions — "Configure and verify optional cross-device portal login, QR activation, explicit approval, browser binding, cancellation, and lifecycle through Caddy" — covering the feature's scope with only one semi-abstract term ("lifecycle"). Not score 5 because the action list has minor gaps (e.g., test/validation work that dominates the body is unmentioned); not 3 because coverage goes well beyond 1-2 actions.

4 / 5

Completeness

The "what" is clear (configure/verify cross-device login with named sub-features), but there is no "Use when..." clause or equivalent explicit trigger guidance; the rubric guideline caps completeness at 3 in that case. Not 2 because the "what" half is concrete and well-delineated.

3 / 5

Trigger Term Quality

Includes natural niche phrases a user would say: "cross-device portal login", "QR activation", "cancellation", "Caddy". Good keyword coverage but missing common variations such as "QR code", "second device", or "transfer"; not 3 since the existing terms are specific and natural rather than generic.

4 / 5

Distinctiveness Conflict Risk

A highly specific niche (Caddy cross-device portal login) with distinct trigger terms, plus an explicit ownership boundary ("Native login and external provider configuration retain their own owners") that reduces overlap with sibling skills. Minimal conflict risk.

5 / 5

Total

16

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

relative_links

Relative link issues: 2 suspicious

Warning

Total

15

/

16

Passed

Repository

greenpau/caddy-security

Path

.codex/skills/configuration-authentication-cross-device/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.