CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

api-gateway-patterns

Comprehensive API gateway patterns skill covering Kong, routing, rate limiting, authentication, load balancing, traffic management, and production gateway architecture

Quality

57%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./plugins/luxor-devops-suite/skills/api-gateway-patterns/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

32%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a well-headed but monolithic pattern catalog: concrete yet partially unreliable (fabricated plugins and inconsistent decK syntax), padded with concepts and generic advice Claude already knows, with no sequenced setup workflow or validation checkpoints. Its size violates the token budget that progressive disclosure via separate reference files is meant to solve.

Suggestions

Split the pattern catalogs into one-level-deep reference files (routing.md, authentication.md, rate-limiting.md, load-balancing.md, security.md, observability.md) and keep SKILL.md as a concise overview with well-signaled links.

Remove or fix non-executable content: invented plugins (request-timeout, proxy-retry, mtls-auth, upstream-health-check, custom-cache-invalidator), the graphql_schemas entity, and inconsistent decK syntax; validate remaining configs against actual decK format.

Add a sequenced quick-start workflow with validation checkpoints (deck gateway validate / ping, deck sync, curl the health/status endpoint, explicit rollback path) and drop textbook explanations (circuit-breaker states, sliding vs fixed windows, generic security best-practice lists).

DimensionReasoningScore

Conciseness

The ~2,380-line body explains concepts Claude already knows ("An API gateway acts as a single entry point", circuit-breaker Closed/Open/Half-Open states, sliding vs fixed windows) and pads with generic best-practice lists ("Never hardcode credentials", "TLS Everywhere"), plus repetitive near-duplicate config blocks. It is not a 1 because much of the bulk is genuinely informative Kong config, but the padding and known-concept explanations are extensive.

2 / 5

Actionability

Concrete YAML examples abound, but a meaningful fraction are not executable as written: invented plugins ("request-timeout", "proxy-retry", "mtls-auth", "upstream-health-check", "custom-cache-invalidator", "acme" as a quota tracker), a nonexistent "graphql_schemas" entity, and inconsistent decK syntax (root-level "service:"/"routes:" vs "services:" lists, plugin "route: name" references that will not resolve). This exceeds "minor gaps" of a 4, yet the bulk of rate-limiting, key-auth, CORS, health-check, and metrics configs are real and usable, so it sits above the minimal/pseudocode level of 2.

3 / 5

Workflow Clarity

There is no assembled workflow: the Quick Reference lists commands (deck sync, kong migrations bootstrap, kong start, curl /status) without ordering or verification, and the canary/blue-green progressions are rough numbered phases with no checkpoints. Deploying gateway config is a batch operation, yet validation steps (config validation, post-deploy health check, rollback verification) are entirely absent, which fits the rough-sequence/no-validation anchor rather than anchor 3's implicit checkpoints.

2 / 5

Progressive Disclosure

No bundle files exist at all; all nine pattern catalogs (routing, rate limiting, auth, load balancing, traffic control, transformation, caching, security, observability) plus best practices and use cases are inlined in one 2,380-line SKILL.md — content that clearly belongs in separate reference files. It is not a 1 because section headers make the monolog navigable, but there are no external references to signal and everything is inline, which matches anchor 2 better than anchor 3's "references present".

2 / 5

Total

9

/

20

Passed

Description

66%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and distinct thanks to the Kong and API-gateway framing, with good natural trigger terms. Its main defect is the missing "when to use" clause, which both caps completeness and weakens its value as a trigger.

Suggestions

Append an explicit trigger clause, e.g. "Use when setting up or configuring an API gateway (Kong), implementing gateway-level auth, rate limiting, or routing, or when the user mentions Kong, reverse proxy, or API gateway."

Add missing natural trigger terms and synonyms: reverse proxy, JWT, OAuth, mTLS, canary deployment, microservices.

Drop filler ("Comprehensive ... skill") and convert topic nouns into concrete actions ("Configure Kong routing, rate limiting, and auth plugins").

DimensionReasoningScore

Specificity

"covering Kong, routing, rate limiting, authentication, load balancing, traffic management, and production gateway architecture" lists several specific capability areas beyond the 1-2 needed for a 3, but they are topic nouns with filler ("Comprehensive ... skill") rather than the concrete verbs of a 5.

4 / 5

Completeness

The description clearly states what the skill covers, but there is no "Use when..." clause or equivalent explicit trigger guidance, which the rubric caps at 3; it is not a 2 because the "what" is concrete and multi-faceted.

3 / 5

Trigger Term Quality

"API gateway", "Kong", "rate limiting", and "load balancing" are natural terms a user would say, but common synonyms and variations (reverse proxy, JWT, OAuth, microservices, canary) are missing, so it falls just short of the comprehensive anchor 5.

4 / 5

Distinctiveness Conflict Risk

Explicitly naming Kong carves a clear niche with product-specific triggers, but generic terms like "authentication", "routing", and "traffic management" create minor overlap risk with ingress, security, or general architecture skills.

4 / 5

Total

15

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

skill_md_line_count

SKILL.md is long (2384 lines); consider splitting into references/ and linking

Warning

Total

15

/

16

Passed

Repository

manutej/luxor-claude-marketplace

Path

plugins/luxor-devops-suite/skills/api-gateway-patterns/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.