api-authentication

Secure API authentication with JWT, OAuth 2.0, API keys. Use for authentication systems, third-party integrations, service-to-service communication, or encountering token management, security headers, auth flow errors.

Quality

84%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

93%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The SKILL.md body is lean, executable, and well-structured, with copy-paste-ready code and a single well-signaled one-level-deep reference. Its only gap is the absence of explicit validation checkpoints/feedback loops for token-related operations.

Dimension	Reasoning	Score
Conciseness	The body is lean and efficient — a comparison table, executable Node.js code, a security checklist, and a single reference pointer, with no padding or explanations of concepts Claude already knows; every token earns its place.	5 / 5
Actionability	Provides fully executable, copy-paste-ready Node.js JWT token-generation and auth-middleware code with concrete error handling, plus a complete Flask reference covering JWT, OAuth 2.0, and API-key implementations, matching the score-5 anchor.	5 / 5
Workflow Clarity	As a largely catalog/reference skill the action is unambiguous, but there is no explicit validation/checkpoint sequence or validate→fix→retry feedback loop for risky operations like token verification, so it falls at 4 rather than 5.	4 / 5
Progressive Disclosure	Clear overview with a single well-signaled one-level-deep reference (references/python-flask.md, which exists and delivers the promised content); Flask implementations are appropriately offloaded while Node.js stays inline, giving easy navigation.	5 / 5
	Total	19 / 20 Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is strong, specific, and explicitly answers both what and when with concrete trigger phrases and an explicit "Use for..." clause. It is concise without fluff and clearly scoped to API authentication.

Suggestions

Lead with concrete verbs describing actions (e.g., "Implement, validate, and rotate JWT/OAuth 2.0/API-key credentials") to strengthen the "what" and push specificity and completeness toward 5.

Add a couple of natural synonym/acronym variants users say (e.g., "login flows", "OAuth login", "token refresh") to broaden trigger-term coverage.

Tighten the broadest trigger ("auth flow errors") to API-specific phrasing to reduce overlap risk with general security skills.

Dimension	Reasoning	Score
Specificity	Names the domain and several concrete components ("JWT, OAuth 2.0, API keys", "token management, security headers, auth flow errors") with only minor coverage gaps, matching the score-4 anchor; it enumerates methods/triggers rather than a comprehensive set of distinct operations, so it is not a 5.	4 / 5
Completeness	Explicitly answers both what ("Secure API authentication with JWT, OAuth 2.0, API keys") and when (an explicit "Use for..." clause), but the "what" is a terse method enumeration rather than a full action description, keeping it at 4 instead of 5.	4 / 5
Trigger Term Quality	Includes several natural phrases users would say ("authentication systems", "third-party integrations", "service-to-service communication", "auth flow errors") with good coverage, but lacks acronym variants or file-extension-style triggers that would push it to 5.	4 / 5
Distinctiveness Conflict Risk	"API authentication" is a clear niche with distinct triggers and minimal conflict risk, though broad phrases like "auth flow errors" could marginally overlap with a generic security skill, placing it at 4 rather than 5.	4 / 5
	Total	16 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: secondsky/claude-skills
Path: plugins/api-authentication/skills/api-authentication/SKILL.md
Commit: 84802a4

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.