Tessl • The package manager for agent skills

SkillPublic

auth

Activate when code touches token management, credential resolution, git auth flows, GITHUB_APM_PAT, ADO_APM_PAT, AuthResolver, HostInfo, AuthContext, or any remote host authentication -- even if 'auth' isn't mentioned explicitly.

Quality

71%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./.agents/skills/auth/SKILL.md

Quality

Content

82%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is an excellent lean reference for this codebase-specific auth domain: every token is project-specific and actionable, from exact env-var names and an executable az command to verbatim diagnostic strings with remediation steps. Structure and disclosure are good, with the only real gaps being slight redundancy in the fallback narrative and an inlined error catalog that could live in a reference file.

Dimension	Reasoning	Score
Conciseness	The body is dense and unpadded: exact env vars, a copy-paste az command, verbatim error strings, and file paths with no re-explanation of concepts Claude already knows. Minor repetition between fallback chain step 3 and the stale-PAT paragraph, plus the verbose-source-line samples, keep it at anchor 4 rather than anchor 5.	4 / 5
Actionability	Guidance is fully concrete: the executable command 'az account get-access-token --resource 499b84ac-1321-427f-aa17-267ca6975798', exact source paths, verbatim diagnostic error copy, and per-case remediation commands (e.g. 'az login --tenant <correct-tenant>') cover the common cases, matching anchor 5 for an instruction-only skill.	5 / 5
Workflow Clarity	The ADO chain is a clearly numbered 1-4 sequence with explicit failure checkpoints (HTTP 401/403, 'is_ado_auth_failure_signal', DNS/TLS re-raise rules) and enumerated diagnostic cases with remediations. It sits at anchor 4 because the body describes system behavior rather than giving Claude a validated step-by-step procedure with error-recovery feedback loops, which anchor 5 requires.	4 / 5
Progressive Disclosure	Sections are well organized and the full resolution flow is correctly deferred to a clearly signaled, one-level-deep canonical doc ('Treat it as the single source of truth'). It stops short of anchor 5 because the bundle contains no reference files, both links point outside the skill directory, and the ~58-line error-message catalog is inlined in SKILL.md rather than split out.	4 / 5
	Total	17 / 20 Passed

Description

47%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is a strong trigger-only description: activation conditions are explicit, concrete, and highly distinctive thanks to exact env-var and class names. Its main weakness is the complete absence of any 'what this skill does' statement, which drags down both completeness and capability specificity.

Suggestions

Add a brief capability statement before the trigger clause, e.g. 'Apply the project's AuthResolver-based token resolution rules (per-org -> global -> credential-fill -> fallback) for GitHub and Azure DevOps hosts.'

Include a couple of natural user phrasings as triggers, such as 'secrets', 'API keys', or 'login/sign-in failures', to complement the env-var and class names.

Clarify what happens on activation (e.g. 'enforces the no-direct-os.getenv rule and ADO bearer fallback chain') so the description answers 'what' as well as 'when'.

Dimension	Reasoning	Score
Specificity	The description names the auth domain with very concrete identifiers ("GITHUB_APM_PAT", "ADO_APM_PAT", "AuthResolver", "token management") but states no actions the skill performs. It matches anchor 2 ("Names the domain but actions are minimal or generic") rather than anchor 3, which requires 1-2 concrete actions — none are explicitly stated.	2 / 5
Completeness	"Activate when code touches ... or any remote host authentication -- even if 'auth' isn't mentioned explicitly" is an explicit, concrete 'when' clause, but the description never states what the skill does. Per anchor 2 ("only 'when' is present without 'what'"), this is the best fit; it does not reach anchor 4, which requires both what and when.	2 / 5
Trigger Term Quality	Good natural keyword coverage ("token management", "credential resolution", "git auth flows", "remote host authentication") plus exact env-var and class-name triggers. It falls short of anchor 5 because common user phrasings like "secrets", "API keys", or "sign in/login" are missing.	4 / 5
Distinctiveness Conflict Risk	Named env vars and class names (GITHUB_APM_PAT, ADO_APM_PAT, AuthResolver, HostInfo, AuthContext) give it a clear niche with minimal conflict risk, but the broad catch-all "any remote host authentication" leaves minor overlap with other auth/security skills, matching anchor 4 rather than anchor 5.	4 / 5
	Total	12 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
relative_links	Relative link issues: 2 suspicious	Warning

	Total	15 / 16 Passed

Repository: microsoft/apm
Path: .agents/skills/auth/SKILL.md
Revision: 0495ced

Reviewed: 5 days ago

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.

auth

Table of Contents

Is this your skill?