CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

manage-portal-applications

Manage the applications that hold API credentials inside an API Experience Hub portal. Use when a portal consumer needs to list their applications, check if a name is available, create a new application, update metadata, rotate the client secret, or delete an application they no longer use.

67

Quality

84%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

High

Do not use without reviewing

SKILL.md
Quality
Evals
Security

Quality

Content

68%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

Highly actionable and clearly sequenced, with complete operation specs for every step. Weaknesses are systematic boilerplate repetition across steps and the absence of a verification checkpoint before the destructive delete operation.

Suggestions

Factor the repeated targetOrganizationId/portalId input descriptions into a single stated convention (e.g., "all operations take the shared targetOrganizationId and portalId inputs described in Prerequisites") and drop them from each block.

Add a pre-deletion validation step to Step 7, such as calling getApplicationDetailById (and checking bound contracts) to confirm the application is unused before deleteApplication runs.

Trim the motivational framing sections ("What you'll build", "What You've Built") and fold the completion checklist into the step sequence to reduce token overhead.

DimensionReasoningScore

Conciseness

The seven operation blocks each repeat identical boilerplate ("Anypoint organization ID hosting the portal" / "Portal ID" descriptions appear seven times verbatim), and motivational sections ("What you'll build", "What You've Built", the checkmark line) add tokens without operational value — systematic tightening opportunities, matching anchor 3 rather than 4's "minor instances".

3 / 5

Actionability

Every step supplies a complete, executable YAML operation block with api, operationId, inputs with descriptions and examples, and JSONPath outputs — copy-paste ready and covering the common cases (e.g., the applicationRequest example with redirectUris), matching anchor 5.

5 / 5

Workflow Clarity

Steps 1–7 are clearly sequenced with useful checkpoints (name-availability check before create, capture-the-secret warning, rotation invalidation note, completion checklist), but Step 7 is a destructive operation ("All contracts bound to it are revoked") with no pre-deletion verification — per the judging guidelines, a destructive workflow without validation is capped at 3 even though sequencing is otherwise strong.

3 / 5

Progressive Disclosure

No bundle files exist, and the body is well organized into a navigable step sequence with clearly signaled related-skill pointers ("request-api-access", "discover-portal-apis"); the repeated shared-input boilerplate is the only content arguably belonging in a shared reference, matching anchor 4's good structure with minor gaps.

4 / 5

Total

15

/

20

Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description: concrete, comprehensive, third-person, with an explicit 'Use when' clause carrying natural trigger phrases. Only weakness is modest synonym coverage (e.g., "app", "client credentials").

DimensionReasoningScore

Specificity

Lists six concrete actions covering the application lifecycle — "list their applications, check if a name is available, create a new application, update metadata, rotate the client secret, or delete an application" — matching the comprehensive-coverage anchor; the unlisted "view details" operation is subsumed by the inventory action, so this fits anchor 5 better than 4's "minor gaps".

5 / 5

Completeness

Explicitly answers both what ("Manage the applications that hold API credentials inside an API Experience Hub portal") and when ("Use when a portal consumer needs to...") with concrete trigger phrases, matching anchor 5 exactly.

5 / 5

Trigger Term Quality

Natural phrases users would say are present ("create a new application", "rotate the client secret", "delete an application"), but a few common synonyms such as "app" or "client credentials" are missing, matching the good-but-not-comprehensive anchor 4 rather than 5's synonym-and-extension coverage.

4 / 5

Distinctiveness Conflict Risk

The niche is clear — portal-consumer credential-bearing application lifecycle in an API Experience Hub portal — and is written in third person with triggers unlikely to fire for neighboring skills like contract request or API discovery, matching anchor 5's minimal conflict risk.

5 / 5

Total

19

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

mulesoft/mulesoft-dx

Path

skills/manage-portal-applications/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.