CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

netlify-access-control

Picks the right Netlify site-protection layer and disambiguates the three unrelated "auth" concepts users conflate — app-user login (Netlify Identity), site-load gating (Password Protection / project visibility), and dashboard SAML SSO. Use it when asked to password-protect a site or Deploy Preview, make a project private/public, restrict a site to your team, require SSO to view a site, set up company-wide or internal-app SSO, invite users to a private project, or know which team member made a request to a private site. Also use it for SSO-session symptoms on protected sites: "logged out mid-session", 401s after about an hour, or token expiry/refresh questions. Not for wiring auth code — route app-login setup to netlify-identity.

Quality

91%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

78%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A strong, information-dense routing skill: it disambiguates first, maps every common ask to a concrete protection layer with exact dashboard paths, plan gating, role permissions, and a runnable SSO-session-refresh snippet, and it properly offloads the two-layer deep-dive to a real reference file. Its main weakness is redundancy — the merged house-rules section duplicates roughly 40% of the body with added meta-commentary, which hurts token efficiency.

Suggestions

De-duplicate the trailing 'Netlify house rules' section: rules 3-5, 7, 9, and 10 restate the auth disambiguation, no-API constraint, internal-app decision, Reviewer remedy, and who-can-change guidance already in the body — keep only rules that add new information, or move the rationale into references/two-layer-pattern.md.

Isolate time-sensitive facts (the 'July 28, 2026' default-visibility cutover and the per-plan gating matrix) into a clearly labeled section or the references file so the routing core stays lean and stale dates are easy to spot.

Trim meta-commentary ('it has happened', 'this rule exists to prevent', 'don't burn iterations') to bare directives — the operative instruction survives without the narrative.

DimensionReasoningScore

Conciseness

The routing core (disambiguation, decision guide, UI paths, constraints) is dense with non-obvious product facts and assumes Claude's competence, but the trailing 'Netlify house rules' section (~60 lines) restates the disambiguation, double-login, no-API, internal-app, Reviewer, and who-can-change guidance already covered above, padded with meta-commentary ('it has happened', 'this rule exists to prevent', 'don't burn iterations'). Date-sensitive facts (the 'July 28, 2026' default-visibility cutover) are inlined rather than isolated, which also counts against efficiency.

3 / 5

Actionability

Every recommendation comes with executable specifics: exact dashboard deep-links (e.g. 'https://app.netlify.com/projects/{site_name}/configuration/general/#project-visibility'), step-by-step UI navigation sequences, a copy-paste-ready JS snippet reading the 'Netlify-Site-Protection-Expires-In' header, exact role names (Reviewers vs Git Contributors vs Internal Builders), and per-plan gating for each option. The decision guide maps each user ask to a concrete layer choice, and the failure directive ('report what you tried and stop') is explicit.

5 / 5

Workflow Clarity

The sequence is clearly signaled — 'First: disambiguate "auth"', then the decision guide, then UI paths, with a failure-handling directive up front ('On failure, report what you tried and stop') and a symptom-driven diagnostic flow for the 401-after-an-hour case. It falls short of 5 only because the routing steps are organized topically rather than as an explicit ordered procedure with checkpoints for the handoff.

4 / 5

Progressive Disclosure

The one deep topic (the combined Password-Protection + Identity pattern) is correctly split into references/two-layer-pattern.md, which exists and is clearly signaled twice in the body ('For the combined layered pattern and its tradeoffs, see references/two-layer-pattern.md'). The reference is one level deep with no nesting, and the body's section headers make navigation easy.

5 / 5

Total

17

/

20

Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

An exemplary description for a routing skill: it states concrete what/when in third person, packs in natural trigger phrasing for both setup requests and symptom reports, and closes with an explicit negative boundary that steers the neighboring netlify-identity skill apart. Dense but not padded — every clause is either a capability or a trigger.

DimensionReasoningScore

Specificity

Concrete actions are named precisely — 'Picks the right Netlify site-protection layer and disambiguates the three unrelated "auth" concepts' — with the three concepts individually named (Netlify Identity, Password Protection / project visibility, dashboard SAML SSO) plus routing and symptom-diagnosis coverage. It is written in third person ('Picks') with no first/second-person penalty, and coverage of the skill's jobs is comprehensive for a routing skill, matching the anchor-5 example's breadth rather than the 'minor gaps' of anchor 4.

5 / 5

Completeness

It explicitly answers 'what' ('Picks the right Netlify site-protection layer and disambiguates the three unrelated "auth" concepts') and 'when' ('Use it when asked to... Also use it for SSO-session symptoms...') with concrete trigger phrases, mirroring the anchor-5 example structure; no 'when' is left implicit.

5 / 5

Trigger Term Quality

Trigger coverage spans natural user phrasings for both setup asks ('password-protect a site or Deploy Preview', 'make a project private/public', 'restrict a site to your team', 'invite users to a private project') and symptom reports users actually say ('"logged out mid-session"', '401s after about an hour', 'token expiry/refresh questions'), including synonyms — this matches anchor 5's comprehensive coverage including variations.

5 / 5

Distinctiveness Conflict Risk

The Netlify site-protection niche is unambiguous and the description includes an explicit negative boundary — 'Not for wiring auth code — route app-login setup to netlify-identity' — plus a three-way concept disambiguation, so overlap risk with the sibling identity skill is actively minimized rather than merely low.

5 / 5

Total

20

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

netlify/context-and-tools

Path

skills/netlify-access-control/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.