CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

configuration-crypto

Configure portal/policy JWT keys, named access signers, strict access-token profiles, token names and lifetimes, discovery, rotation, and System API encryption keys.

Quality

78%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./.codex/skills/configuration-crypto/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

82%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-organized, highly actionable configuration reference: executable Caddyfile examples, explicit troubleshooting checkpoints, and properly split reference files. Minor room remains in trimming dense low-frequency detail out of the main body.

DimensionReasoningScore

Conciseness

The body is dense with project-specific facts (e.g. 'the caddy-security parser only checks that a crypto line has at least three arguments') and never teaches concepts Claude already knows, but a few passages (Ed25519 label-relabeling behavior, the long Fixtures section) could be trimmed or moved.

4 / 5

Actionability

Copy-paste-ready Caddyfile snippets cover the common cases — a complete portal/policy pairing, a full secrets-manager block, cookie-name mirroring — plus an exhaustive supported-forms grammar, matching the fully-executable anchor.

5 / 5

Workflow Clarity

A clear progression from mental model to common pairing to detailed forms, with explicit diagnostic feedback loops in Failure Patterns ('If a policy rejects portal-issued tokens, verify that portal signing material and policy verification material match...'); minor gaps remain since it is a reference skill without a numbered change-then-validate loop.

4 / 5

Progressive Disclosure

The two deep-dive topics are correctly split into well-signaled, one-level-deep references (references/access-signing.md, references/system-api-keys.md, both verified present), but the ~350-line body retains sections (Ed25519 label behavior, Fixtures) that could live in reference files.

4 / 5

Total

17

/

20

Passed

Description

66%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A domain-specific, concrete description of what the skill configures, with minimal conflict risk against unrelated skills. Its main weakness is the complete absence of 'when to use this' trigger guidance, plus a few missing natural trigger terms like 'crypto' and 'Caddyfile'.

Suggestions

Append an explicit trigger clause, e.g. 'Use when configuring crypto key or access token profile directives in a Caddyfile security block, or when troubleshooting JWT signing/verification mismatches.'

Include the natural directive-level terms users would actually say — 'crypto', 'Caddyfile', 'sign-verify'/'verify keys' — alongside the capability nouns.

Lead with the primary action ('Configure JWT signing and verification keys...') so the single verb is not stretched across seven heterogeneous objects.

DimensionReasoningScore

Specificity

Names the domain and several concrete capability objects ('portal/policy JWT keys, named access signers, strict access-token profiles, token names and lifetimes, discovery, rotation, and System API encryption keys'), but relies on a single verb ('Configure') rather than a list of distinct actions, so it sits below the comprehensive anchor 5.

4 / 5

Completeness

The 'what' is clear and specific, but there is no 'Use when...' clause or equivalent explicit trigger guidance, which caps completeness at 3 per the rubric guideline.

3 / 5

Trigger Term Quality

Good natural-keyword coverage ('JWT keys', 'access signers', 'token names and lifetimes', 'rotation'), but misses the most natural triggers for this domain such as the 'crypto' directive itself, 'Caddyfile', and 'sign/verify' key forms.

4 / 5

Distinctiveness Conflict Risk

The niche is distinct ('portal/policy JWT keys', 'System API encryption keys'), with only minor overlap risk against closely related sibling skills such as configuration-authentication and configuration-authorization.

4 / 5

Total

15

/

20

Passed

Validation

87%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

relative_links

Relative link issues: 7 suspicious

Warning

referenced_paths_exist

Referenced path issues: 1 missing, 1 deeper-than-1-level

Warning

Total

14

/

16

Passed

Repository

greenpau/caddy-security

Path

.codex/skills/configuration-crypto/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.