CtrlK
BlogDocsLog inGet started
Tessl Logo

oauth-implementation

OAuth 2.0 and OpenID Connect authentication with secure flows. Use for third-party integrations, SSO systems, token-based API access, or encountering authorization code flow, PKCE, token refresh, scope management errors.

67

Quality

80%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

78%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A compact, well-organized skill body with executable examples and a clean one-level reference structure. The main improvement would be making the Express example fully runnable (instantiating app, defining PROVIDER_URL) and tightening the redundant title/intro.

Suggestions

Make the Express auth-code example fully runnable: add `const app = express();`, define `PROVIDER_URL`, and remove the unused `jsonwebtoken` import.

Tighten conciseness by dropping the restated 'Implement OAuth 2.0 and OpenID Connect for secure authentication.' line under the H1, since the frontmatter description already states it.

Add a brief error-recovery note in the callback (e.g., handle non-200 token responses / invalid_grant) to strengthen workflow_clarity feedback loops.

DimensionReasoningScore

Conciseness

The body is lean with no padding of concepts Claude already knows; minor redundancy (the H1 plus the restated intro line, and Step 1/Step 2 comments) keeps it just below the 'every token earns its place' top anchor.

4 / 5

Actionability

Provides concrete, mostly copy-paste-ready code for the auth code flow and PKCE, but small gaps (app is never instantiated with express(), PROVIDER_URL is undefined, jwt is required but unused) place it at 'mostly executable, minor gaps'.

4 / 5

Workflow Clarity

The authorization code flow is explicitly sequenced (redirect then callback) with a validation checkpoint (state mismatch check), but lacks broader error-recovery feedback loops, fitting 'clear sequence with most checkpoints, minor gaps'.

4 / 5

Progressive Disclosure

Sections are well-organized, core flows are inline, and the single reference to references/python-java.md is one level deep, clearly signaled, and bulleted with its contents; the referenced file exists, matching the top anchor.

5 / 5

Total

17

/

20

Passed

Description

82%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, well-structured description with explicit what-and-when guidance and rich natural trigger terms. Its only weakness is specificity: it states one broad capability rather than enumerating multiple concrete actions.

DimensionReasoningScore

Specificity

Names the domain (OAuth 2.0 / OpenID Connect) and one broad action ('authentication with secure flows') but does not list multiple concrete actions, matching the '1-2 concrete actions, not comprehensive' anchor rather than the comprehensive 4-5 anchors.

3 / 5

Completeness

Explicitly answers both what ('OAuth 2.0 and OpenID Connect authentication with secure flows') and when (an explicit 'Use for...' clause with concrete trigger phrases), matching the top anchor.

5 / 5

Trigger Term Quality

Strong natural keyword coverage ('SSO systems', 'third-party integrations', 'token-based API access', 'authorization code flow', 'PKCE', 'token refresh', 'scope management') that users would actually say; a few synonyms are absent, so it sits at 'good coverage, a few missing' rather than comprehensive.

4 / 5

Distinctiveness Conflict Risk

Occupies a clear niche (OAuth/OIDC authentication) with distinct, specific triggers (PKCE, authorization code flow, scope management) that minimize overlap with other skills.

5 / 5

Total

17

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
secondsky/claude-skills
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.