CtrlK
BlogDocsLog inGet started
Tessl Logo

webiny-admin-permissions

Admin-side permission UI registration and DI-backed permission checking. Use this skill when adding permission controls to the admin UI — schema-based auto-generated forms, injectable permissions via createPermissionsAbstraction/ createPermissionsFeature, typed hooks (createUsePermissions), the HasPermission component (createHasPermission), and the Security.Permissions component props. Covers both simple apps and complex multi-entity permission schemas.

74

Quality

93%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

90%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

An exemplary framework-API skill body: every step is executable with exact file paths, sequencing across the three layers is unambiguous, and there is no wasted prose. The two remaining gaps are the absence of verification checkpoints and the fully inlined reference tables in a ~300-line file.

Suggestions

Add a short validation step at the end (e.g., 'After registration, confirm the permission accordion appears under Security settings and that usePermissions().canRead("product") returns the expected value') to give the workflow an explicit checkpoint.

Move the detailed Schema Reference / Entity Definition / Security.Permissions Props tables into a references/api.md file, keeping a minimal quick-start schema example inline in SKILL.md.

DimensionReasoningScore

Conciseness

Lean and efficient with zero padding — no generic explanation of permissions, DI, or React concepts; every table, code block, and prose note is framework-specific API knowledge Claude cannot already have. The only near-redundancy (the Admin/API prefix comparison) directly serves a real integration pitfall.

5 / 5

Actionability

Fully executable, copy-paste-ready code for every artifact in the pipeline — schema, abstraction + namespace type, feature, extension registration JSX, hook, and component — each with an exact file path, plus concrete usage listings for canRead/canEdit/... and all HasPermission variants. The DI-injection block is the sole template-style example, which is justified as a pattern illustration.

5 / 5

Workflow Clarity

Layers 1→2→3 form a clear, numbered sequence (schema → abstraction → feature → registration → hooks/components), reinforced by the file-structure tree. Missing explicit validation checkpoints (e.g., 'verify the permission accordion renders in the admin', 'typecheck that canRead("bogus") errors') keeps it at anchor 4 rather than 5; not 3 since the skill involves no destructive or batch operations requiring a cap.

4 / 5

Progressive Disclosure

Well-organized sections with clear headers and a one-level 'Related Skills' pointer list, but everything is inlined — the detailed schema/entity/actions and Security.Permissions prop tables (~300 lines total) could be split into a references/ file. Anchor 4: good structure, minor organization gaps.

4 / 5

Total

18

/

20

Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description: concrete third-person capability list, explicit use-when trigger, and clear admin-side scoping that distinguishes it from related skills. Its only weakness is reliance on API names over natural synonyms for trigger terms.

DimensionReasoningScore

Specificity

Lists multiple concrete capabilities — 'Admin-side permission UI registration and DI-backed permission checking', 'schema-based auto-generated forms', 'injectable permissions via createPermissionsAbstraction/createPermissionsFeature', 'typed hooks (createUsePermissions)', 'the HasPermission component', 'the Security.Permissions component props' — comprehensively covering the skill's surface with no vague filler.

5 / 5

Completeness

Explicitly answers 'what' (UI registration, DI-backed permission checking, named artifacts) and 'when' ('Use this skill when adding permission controls to the admin UI') with a concrete trigger phrase. Not 4 — the when-clause is explicit rather than implied.

5 / 5

Trigger Term Quality

Good keyword coverage via 'adding permission controls to the admin UI' plus the API names users would mention, but it leans on function names and misses common natural synonyms like 'access control', 'roles', or 'RBAC'. Anchor 4 fits: good coverage, a few natural terms missing.

4 / 5

Distinctiveness Conflict Risk

'Admin-side' explicitly scopes it against the sibling API-side skill, and the named admin-only components (Security.Permissions, createHasPermission) give it a clear niche with minimal conflict risk.

5 / 5

Total

19

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
webiny/webiny-js
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.