authentication-patterns

Authentication and authorization patterns including OAuth2, JWT, RBAC, session management, and PKCE flows

Quality

80%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/authentication-patterns/SKILL.md

Quality

Content

87%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A strong, actionable reference: lean executable TypeScript across all auth patterns with good section organization and no concept padding. The only gap is workflow clarity — the OAuth2 callback lacks explicit validation/error-checking checkpoints.

Suggestions

Add an explicit validation step in the OAuth2 callback (check tokenResponse.ok / error field before decoding id_token) to model a validate→handle-error feedback loop.

For the OAuth2 PKCE flow, surface the multi-step sequence as a short numbered list with a 'validate the token response' checkpoint before the code block, so the workflow is clear independent of reading the code.

Optional: if the RBAC model or OAuth2 flow grows, split them into referenced files to keep the overview lean, though the current self-contained organization is already acceptable.

Dimension	Reasoning	Score
Conciseness	The body is almost entirely executable TypeScript with minimal prose (e.g. 'Short-lived access tokens (15 minutes)... Store refresh tokens in HTTP-only cookies.') and no explanation of concepts Claude already knows, matching the 'lean and efficient; every token earns its place' anchor.	3 / 3
Actionability	Every section provides complete, copy-paste-ready TypeScript (generateTokens, authenticate/authorize middleware, PKCE generation, RBAC permission checks), matching the 'fully executable code/commands; copy-paste ready' anchor rather than the pseudocode level of 2.	3 / 3
Workflow Clarity	The OAuth2 PKCE flow has a clear login→callback sequence, but validation checkpoints are only implicit (the /auth/callback handler never checks the token response for errors before decoding id_token), and the closing Checklist is a reference list rather than an inline validate→fix→retry loop, so it sits at 'sequence present but checkpoints missing or implicit' rather than 3.	2 / 3
Progressive Disclosure	It is a self-contained skill with no bundle files and no nested references, organized into clearly headed sections (JWT, Middleware, OAuth2, RBAC, Anti-Patterns, Checklist); per the guideline, well-organized sections with no need for external references score 3.	3 / 3
	Total	11 / 12 Passed

Description

72%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A specific, distinctive description that names the right auth-domain keywords, but it omits any explicit 'Use when...' trigger guidance, which caps its completeness. Adding a usage-trigger clause would lift the weakest dimension.

Suggestions

Append an explicit trigger clause, e.g. 'Use when implementing login, token issuance/validation, role-based access control, or OAuth2/OIDC flows.'

Lead with a concrete action verb ('Implements/Generates/Validates authentication and authorization patterns...') to push specificity from a topic list to concrete actions.

Add natural user-facing variations like 'login', 'tokens', 'permissions', or 'access control' alongside the protocol names to broaden trigger coverage.

Dimension	Reasoning	Score
Specificity	Quotes 'Authentication and authorization patterns including OAuth2, JWT, RBAC, session management, and PKCE flows' — it names a concrete domain and several specific patterns, but uses no action verbs (e.g. 'implement', 'generate', 'validate'), so it does not reach the 'multiple specific concrete actions' anchor of 3.	2 / 3
Completeness	It clearly states what the skill covers (the pattern list) but has no 'Use when...' clause or equivalent trigger guidance, which the guidelines say caps completeness at 2; it is above 1 because the 'what' is explicit and specific.	2 / 3
Trigger Term Quality	Natural terms users say are well covered — 'Authentication', 'authorization', 'JWT', 'OAuth2', 'session management' — matching the 'good coverage of natural terms' anchor; it is not the level below because the keywords are common developer phrasings rather than obscure jargon.	3 / 3
Distinctiveness Conflict Risk	The auth/authz niche with JWT/OAuth2/PKCE/RBAC triggers is clearly distinct and unlikely to fire for unrelated skills, matching the 'clear niche with distinct triggers' anchor.	3 / 3
	Total	10 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: rohitg00/awesome-claude-code-toolkit
Path: skills/authentication-patterns/SKILL.md
Commit: ebdf1d5

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.