CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

auth-implementation-patterns

Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems. Use when implementing auth systems, securing APIs, or debugging security issues.

Quality

76%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/auth-implementation-patterns/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

57%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is concise, well-sectioned, and free of concept over-explanation, but its guidance remains a high-level planning checklist: it defers all detailed examples to a playbook file that is missing from the bundle, and includes no validation checkpoints for its design workflow. Fixing the broken reference and adding concrete executable guidance would raise actionability and workflow clarity substantially.

Suggestions

Fix the dangling 'resources/implementation-playbook.md' reference — either add the playbook file to the bundle or remove the deferral and inline the essential patterns, since the missing file leaves the Instructions with no detailed examples to fall back on.

Add one or two concrete, executable artifacts to the Instructions (e.g., a JWT validation middleware snippet, a specific token-lifecycle checklist, or named library/tool choices) so the guidance goes beyond planning-level directives.

Add a validation checkpoint to the workflow, such as 'Verify token expiry and refresh handling with a test request before wiring authorization middleware' or a final step to confirm policy enforcement points cover every protected route.

DimensionReasoningScore

Conciseness

The body is lean and assumes Claude's competence — no explanations of what JWT or OAuth2 is, and sections are tight. One minor trimmable instance remains: the intro sentence 'Build secure, scalable authentication and authorization systems using industry-standard patterns and modern best practices' duplicates the heading with buzzwords ('industry-standard', 'modern best practices'), keeping it just below anchor 5.

4 / 5

Actionability

Instructions name concrete artifacts and options ('Choose auth strategy (session, JWT, OIDC)', 'Plan secrets storage, rotation, logging, and audit requirements'), which exceeds bare hints — but everything stays at the planning level with no code, commands, or specific how-to steps, and the promised detailed examples live in a file that is not in the bundle. Anchor 3 ('some concrete guidance but incomplete; missing key details') fits better than anchor 4.

3 / 5

Workflow Clarity

The five instruction bullets form a coherent design sequence (define constraints -> choose strategy -> design authorization -> plan secrets/audit), but no validation or verification checkpoints exist anywhere — nothing like 'verify token expiry and refresh before wiring middleware'. Sequence present with checkpoints missing matches anchor 3 rather than anchor 4's 'most checkpoints present'.

3 / 5

Progressive Disclosure

Sections are well-organized and the reference is clearly signaled one level deep, but the body twice points to 'resources/implementation-playbook.md', which does not exist in the bundle (no resources/ directory is present). Scoring against the actual bundle structure per the judging guidelines, a dangling reference that strands the skill's only source of detailed examples is more than a minor organization gap, so anchor 4 does not hold; anchor 3 applies.

3 / 5

Total

13

/

20

Passed

Description

83%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description that clearly states what the skill covers and when to use it, with good natural trigger terms and named technologies. It could reach the top anchors by using more concrete action verbs and adding common synonyms like login, SSO, and tokens.

DimensionReasoningScore

Specificity

The description lists several specific capabilities — 'JWT, OAuth2, session management, and RBAC' — but the actions themselves ('Master', 'build secure, scalable access control systems') are generic rather than concrete operations. This sits between anchor 3 (only 1-2 concrete actions) and anchor 5 (comprehensive concrete actions), matching anchor 4's 'several specific actions; minor gaps'.

4 / 5

Completeness

It clearly answers both questions: the 'what' ('Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems') and an explicit 'when' ('Use when implementing auth systems, securing APIs, or debugging security issues'). This matches the anchor-5 example structure with concrete trigger phrases.

5 / 5

Trigger Term Quality

Natural phrases like 'implementing auth systems, securing APIs, or debugging security issues' plus domain keywords (JWT, OAuth2, RBAC, session management) give good coverage. It falls short of anchor 5 because common synonyms users would say — 'login', 'SSO', 'sign-in', 'tokens' — are missing.

4 / 5

Distinctiveness Conflict Risk

The auth/authz niche is distinct with specific triggers (JWT, OAuth2, RBAC), but 'debugging security issues' is broad enough to overlap with general security-review or API-security skills. Mostly distinct with minor overlap risk, matching anchor 4 rather than anchor 5's 'minimal conflict risk'.

4 / 5

Total

17

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

rmyndharis/antigravity-skills

Path

skills/auth-implementation-patterns/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.