CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

oauth2-authentication

Comprehensive OAuth2 authentication skill covering authorization flows, token management, PKCE, OpenID Connect, and security best practices for modern authentication systems

Quality

65%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./plugins/luxor-backend-toolkit/skills/oauth2-authentication/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

45%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The skill is rich in executable, multi-language code and reasonably well-sequenced workflows, but it is a severely verbose, monolithic 2500-line document that re-teaches OAuth2 basics and makes no use of progressive disclosure.

Suggestions

Move the conceptual 'Core Concepts', grant-type overviews, and server-implementation material into separate reference files (e.g., references/grants.md, references/server.md) and keep SKILL.md a lean overview pointing to them.

Cut the textbook explanations of OAuth2 fundamentals and terminology that Claude already knows; retain only the non-obvious guidance and the executable code.

Define or stub the helper functions referenced in the server implementation (getClient, storeAuthorizationCode, generateAccessToken) so the examples are self-contained and runnable.

DimensionReasoningScore

Conciseness

The ~2530-line body extensively re-teaches OAuth2 fundamentals, terminology, and grant-type concepts Claude already knows (e.g., 'OAuth2 is an authorization framework that enables applications to obtain limited access...'), making it severely verbose and heavily padded.

1 / 5

Actionability

Provides substantial copy-paste-ready code for auth code flow, PKCE, client credentials, OIDC validation, and server endpoints, but several examples rely on undefined helper stubs (getClient, storeAuthorizationCode, generateAccessToken), leaving minor gaps.

4 / 5

Workflow Clarity

Implementation is laid out in clear numbered steps (Step 1 Configuration through Step 6 Logout) with validation checkpoints (state validation, PKCE validation, token-expiry refresh-and-retry), though feedback loops are not uniformly explicit across all flows.

4 / 5

Progressive Disclosure

Content is a monolithic single SKILL.md with no bundle files and no external references; large tracts (conceptual reference, per-flow implementations, server implementation) that belong in separate reference files are all inlined despite reasonable section headers.

2 / 5

Total

11

/

20

Passed

Description

70%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and distinctive, naming a clear OAuth2/OIDC niche with good trigger keywords. Its main weakness is the absence of an explicit 'Use when...' trigger clause, which caps completeness.

Suggestions

Add an explicit 'Use when...' clause naming concrete triggers (e.g., 'Use when implementing OAuth2 login, social login, SSO, or token-based API authentication').

Include common synonyms and colloquial terms users say ('login', 'SSO', 'single sign-on', 'social login') alongside the technical keywords.

Reframe the capability list with action verbs ('implements authorization flows', 'manages tokens', 'validates ID tokens') to lift specificity toward the comprehensive anchor.

DimensionReasoningScore

Specificity

Names the OAuth2 domain and several concrete capabilities ('authorization flows, token management, PKCE, OpenID Connect, and security best practices'), though these read as covered topics rather than crisp action verbs, leaving minor gaps versus the comprehensive anchor.

4 / 5

Completeness

The 'what' is clear (covers OAuth2 authentication across listed areas), but there is no 'Use when...' clause or equivalent explicit trigger guidance, so completeness is capped at 3 per the rubric.

3 / 5

Trigger Term Quality

Includes strong natural keywords (OAuth2, authentication, PKCE, OpenID Connect) that users would say, but omits common synonyms such as login, SSO, single sign-on, and social login.

4 / 5

Distinctiveness Conflict Risk

Occupies a clear niche anchored by distinctive triggers (PKCE, OpenID Connect) with minimal overlap risk against other skills.

5 / 5

Total

16

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

skill_md_line_count

SKILL.md is long (2541 lines); consider splitting into references/ and linking

Warning

Total

15

/

16

Passed

Repository

manutej/luxor-claude-marketplace

Path

plugins/luxor-backend-toolkit/skills/oauth2-authentication/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.