CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

netlify-access-control

Picks the right Netlify site-protection layer and disambiguates the three unrelated "auth" concepts users conflate — app-user login (Netlify Identity), site-load gating (Password Protection / project visibility), and dashboard SAML SSO. Use it when asked to password-protect a site or Deploy Preview, make a project private/public, restrict a site to your team, require SSO to view a site, set up company-wide or internal-app SSO, invite users to a private project, or know which team member made a request to a private site. Also use it for SSO-session symptoms on protected sites: "logged out mid-session", 401s after about an hour, or token expiry/refresh questions. Not for wiring auth code — route app-login setup to netlify-identity.

Quality

89%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

The canonical home for this skill is netlify-access-control in netlify/context-and-tools

SKILL.md
Quality
Evals
Security

Quality

Content

73%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a dense, highly actionable routing guide — exact UI paths, plan gating, footguns, and executable code — with a clear disambiguation-first workflow and a properly signaled one-level reference file. Its main defect is redundancy: the merged 'Netlify house rules' section at the end duplicates most of the guidance already given, inflating token cost without adding instruction value.

Suggestions

Deduplicate the trailing 'Netlify house rules (access-control)' section: every rule that restates the no-API boundary, double-login/context.user guidance, netlify-identity routing, Reviewer remedy, or who-can-change-settings list already appears in the body above — keep a single statement of each.

If the house-rules block must remain for ctx-gen merging, move it to a reference file (like two-layer-pattern.md) or collapse it to a short pointer so SKILL.md carries the guidance once.

Consolidate plan-gating details that currently appear in both the decision guide and the 'Constraints & footguns' section (e.g. 'Password not available on Credit-based Free/Personal' is stated three times) into the constraints section alone.

DimensionReasoningScore

Conciseness

Roughly 60 of the ~155 body lines are a merged "Netlify house rules" section that restates content already delivered above it nearly verbatim — the no-API/never-curl rule, the double-login no-bridge guidance, the context.user behavior, the netlify-identity routing, the internal-app single-sign-in decision, the Reviewer remedy, and the who-can-change-settings list all appear twice. This is several unnecessary duplicated sections (anchor 2), not merely 'some' tightening (anchor 3), even though the non-duplicated material itself is lean and assumes Claude's competence.

2 / 5

Actionability

Guidance is fully executable for a no-API domain: exact dashboard click paths with templated URLs (e.g. "Project configuration > General > Visitor access > Project visibility — https://app.netlify.com/projects/{site_name}/configuration/general/#project-visibility"), plan-gated options for every recommendation, a copy-paste-ready JS snippet for the 401/refresh symptom, and doc URLs for out-of-scope specifics. Not level 4, as there are no material gaps for the common cases.

5 / 5

Workflow Clarity

The routing workflow is unambiguous and correctly ordered: "First: disambiguate 'auth' — three unrelated layers", then a decision guide mapping each user intent to a specific layer, then exact UI paths, then constraints/footguns that act as checkpoints (e.g. "Free/Personal have no Password option — use Private", "Internal Builders cannot make a project public"). As a simple single-purpose skill with no destructive or batch operations, its single action — pick the layer — is unambiguous, meeting the level-5 exception.

5 / 5

Progressive Disclosure

The single bundle file, references/two-layer-pattern.md, is real, one level deep, and well-signaled with its purpose stated inline ("For the combined layered pattern and its tradeoffs, see references/two-layer-pattern.md"), and headers make the body navigable. It falls short of level 5 because the trailing duplicated house-rules block and some long inline constraint paragraphs (e.g. plan-gating details repeated across sections) could be organized or split better, leaving minor structure gaps.

4 / 5

Total

16

/

20

Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

An exemplary routing-skill description: it states what it does (pick the protection layer, disambiguate three conflated 'auth' concepts), gives explicit and varied 'use when' triggers including user-reported symptom phrasing, and closes with an explicit boundary against the sibling netlify-identity skill. The density is content-bearing rather than padded.

DimensionReasoningScore

Specificity

The description names concrete actions — "Picks the right Netlify site-protection layer and disambiguates the three unrelated 'auth' concepts" — and concretely enumerates each of the three layers (app-user login (Netlify Identity), site-load gating (Password Protection / project visibility), dashboard SAML SSO), comprehensively covering the skill's routing scope. It is dense rather than padded, so it is not the level below (4) where coverage would have minor gaps.

5 / 5

Completeness

Both halves are explicit: what ("Picks the right Netlify site-protection layer and disambiguates the three unrelated 'auth' concepts") and when ("Use it when asked to password-protect a site or Deploy Preview, make a project private/public, ..."), with concrete trigger phrases and an explicit negative scope ("Not for wiring auth code — route app-login setup to netlify-identity"). This is the level-5 anchor exactly, not level 4 where the 'when' would be less specific.

5 / 5

Trigger Term Quality

Trigger phrasing is comprehensive and natural: "password-protect a site or Deploy Preview", "make a project private/public", "restrict a site to your team", "require SSO to view a site", "invite users to a private project", plus symptom phrasings users actually report ("logged out mid-session", "401s after about an hour", "token expiry/refresh"). This covers both setup and troubleshooting vocabulary with synonyms, matching the level-5 anchor; no common variation is obviously missing.

5 / 5

Distinctiveness Conflict Risk

It carves out a clear niche (Netlify site-protection layering) and actively de-conflicts against the nearest sibling skill by explicitly routing app-login setup to netlify-identity and separating dashboard SAML SSO from app-user login. Minimal conflict risk; not level 4, which would allow minor overlap with closely related skills.

5 / 5

Total

20

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

netlify/context-and-tools

Path

agent-plugin/skills/netlify-access-control/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.