CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

auth

Activate when code touches token management, credential resolution, git auth flows, GITHUB_APM_PAT, ADO_APM_PAT, AuthResolver, HostInfo, AuthContext, or any remote host authentication -- even if 'auth' isn't mentioned explicitly.

60

Quality

75%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./.apm/skills/auth/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

82%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a dense, high-signal reference: every fact is project-specific and actionable, with exact commands, verbatim error messages, and clearly sequenced fallback behavior. Its main weaknesses are the absence of a concrete usage example for the AuthResolver key rule and inline diagnostic detail that could be split into a bundled reference file.

Suggestions

Add a 3-5 line code example showing correct AuthResolver usage vs. the forbidden os.getenv() pattern, since the key rule is the skill's central instruction.

Move the six diagnostic cases into a references/ file (e.g., references/ado-diagnostics.md) and keep a one-line summary plus the link in SKILL.md.

State explicitly what Claude should do when the skill activates (e.g., 'check changes against the canonical flowchart and fix the diagram in the same PR if behavior diverges') as a short workflow step list.

DimensionReasoningScore

Conciseness

The body is lean and entirely project-specific: fallback chains, exact env var names, the AAD resource GUID, and verbatim diagnostic message text. It assumes Claude's competence — no general auth concepts are explained — and every line carries information Claude could not know otherwise.

5 / 5

Actionability

Concrete, executable guidance throughout: a copy-paste-ready command ('az account get-access-token --resource 499b84ac-1321-427f-aa17-267ca6975798'), exact file paths and class names ('src/apm_cli/core/auth.py', 'GitHubTokenManager.ADO_BEARER_SOURCE'), and per-case remediation steps. Minor gaps: the key rule ('all auth flows MUST go through AuthResolver') is stated without a short usage example.

4 / 5

Workflow Clarity

The ADO chain is a clearly numbered sequence with explicit fallback conditions ('after HTTP 401/403 or a recognized Git authentication failure') and enumerated failure cases with remediation. It stops short of anchor 5 because there are no explicit validation checkpoints or fix-retry loops for Claude's own edits — the content describes the system's behavior more than a step-by-step editing workflow.

4 / 5

Progressive Disclosure

Well-organized sections (activation triggers, key rule, canonical reference, ADO chain, diagnostics) with external references clearly signaled and one level deep: the persona link and the canonical authentication doc with its mermaid flowchart. Not a 5 because the six diagnostic cases are moderately detailed inline material that could live in a reference file, and the referenced paths point outside the skill bundle rather than to bundled references.

4 / 5

Total

17

/

20

Passed

Description

58%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is an excellent trigger list with outstanding distinctiveness and natural keyword coverage, but it is missing the 'what' half of the equation — it never describes the skill's capabilities or purpose. Adding one sentence stating what the skill provides (e.g., the canonical auth resolution flow and diagnostics guidance) would lift it substantially.

Suggestions

Add a 'what' clause before the trigger list, e.g., 'Provides the canonical token resolution flow (per-org -> global -> credential-fill -> fallback) and ADO bearer-auth diagnostics. Activate when...'

Include the other token env vars the body mentions (GITHUB_TOKEN, GH_TOKEN) as triggers, since code touching those should also activate this skill.

Mention the domain phrase 'APM CLI' or 'remote host authentication for APM' so the scope of 'any remote host authentication' is bounded to this project.

DimensionReasoningScore

Specificity

The description names the auth domain with concrete identifiers ('GITHUB_APM_PAT', 'ADO_APM_PAT', 'AuthResolver', 'HostInfo', 'AuthContext') but contains no capability statements whatsoever — no action the skill performs is described. It matches 'names the domain but actions are minimal or generic' rather than anchor 3, which requires 1-2 concrete actions.

2 / 5

Completeness

Only the 'when' is present — the description opens with 'Activate when code touches...' and lists triggers, but never states what the skill does. Anchor 2 is 'only when is present without what'; score 3 would require a clear 'what', which is entirely absent.

2 / 5

Trigger Term Quality

Comprehensive natural-term coverage: 'token management', 'credential resolution', 'git auth flows', 'any remote host authentication', plus exact env var and class-name triggers and the explicit catch-all 'even if auth isn't mentioned explicitly'. Users and code review contexts would naturally hit these terms.

5 / 5

Distinctiveness Conflict Risk

A clear niche defined by unique project-specific triggers (ADO_APM_PAT, AuthResolver, AuthContext, APM token variables) that no other skill would share; conflict risk with generic skills is minimal.

5 / 5

Total

14

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

relative_links

Relative link issues: 2 suspicious

Warning

Total

15

/

16

Passed

Repository

microsoft/apm

Path

.apm/skills/auth/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.