Content
88%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A strong, dense body: the verification section is the highlight, delivering executable constant-time Basic auth code with explicit error responses and honest security caveats (no signature, no replay protection). The main deductions are ~25 lines of cross-promotional material at the end and references to examples/ directories that are absent from the bundle.
Suggestions
Trim the "Related Skills" section (8 links) and the "Recommended: webhook-handler-patterns" promo block to 1–2 lines each, or move them to a single reference file, to reclaim ~25 lines of padding.
Fix the dangling examples/express/, examples/nextjs/ and examples/fastapi/ references: either include the examples directory in the bundle or point to the concrete GitHub URLs instead of relative paths that don't resolve locally.
Consider merging the short "Environment Variables" section into the Verification section so the credential variables appear next to the code that consumes them.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The core body (verification code, event table, env vars, CLI) is lean and assumes competence — e.g. "Decode it, split on the first colon, and compare the username and the password each in constant time" teaches only non-obvious gotchas. Not 5: roughly 25 trailing lines (an 8-link "Related Skills" list, the "Recommended" cross-promotion section, and attribution boilerplate) are promotional padding that earns no tokens for the task. | 4 / 5 |
Actionability | Fully executable, copy-paste-ready Node verification function (regex scheme match, first-colon split via indexOf(0x3a), sha256+timingSafeEqual, no short-circuit) with explicit return codes ("Return 401 when this fails, 400 for a body that isn't a JSON object, and 200 once handled"), raw-body guidance, concrete env vars, and a runnable CLI command. Not 4: the common case is covered end-to-end with no missing key details. | 5 / 5 |
Workflow Clarity | The handler sequence is explicit with validation checkpoints: authenticate first with per-failure responses (401 on auth failure, 400 on non-JSON body), parse only after the check, respond 200 within 5 seconds, and dedupe on message IDs for retries. Not 4: every failure mode has an explicit checkpoint and response, not just most. | 5 / 5 |
Progressive Disclosure | The three real references (overview.md, setup.md, verification.md) are well-signaled, one level deep, and described in the Resources section, with detail appropriately split out of SKILL.md. Not 5: the body twice references examples/express/, examples/nextjs/ and examples/fastapi/ ("For complete handlers with tests" and in Resources), but no examples/ directory exists in the bundle, so those pointers dangle. | 4 / 5 |
Total | 18 / 20 Passed |