Name: webiny-api-permissions
Rating: 63.2 (1 reviews)
Author: webiny

webiny-api-permissions

Schema-based permission system for API features. Use this skill when implementing authorization in use cases, defining permission schemas with createPermissionSchema, creating injectable permissions via createPermissionsAbstraction/createPermissionsFeature, checking read/write/delete/publish permissions, handling own-record scoping, or testing permission scenarios. Covers the full pattern from schema definition to use case integration to test matrices.

Quality

75%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/user-skills/api/permissions/SKILL.md

Quality

Content

65%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-structured reference for the permission pattern, undermined by duplicated use-case boilerplate, a lack of verification feedback loops around destructive operations, and a monolithic single-file structure with no external reference split.

Suggestions

Collapse the five Get/List/Update/Delete/Publish use-case blocks into one parameterized skeleton plus a short per-case delta table to remove duplicated DI-constructor boilerplate.

Add an explicit validate/retry checkpoint after the fetch+check steps in the Delete (and other destructive) workflows so authorization failure is handled as a feedback loop, not just an early return.

Split the test-matrix and admin-side matching sections into referenced files (e.g. TESTS.md, ADMIN-MATCHING.md) so SKILL.md stays a concise overview with one-level-deep references.

Dimension	Reasoning	Score
Conciseness	The content is well organized and assumes competence, but five near-identical use-case blocks (Get/List/Update/Delete/Publish) duplicate DI-constructor boilerplate and the schema-fields table pushes toward reference-manual density — 'mostly efficient but could be tightened'. Not a 3 because the repetition across use cases could be collapsed into a shared skeleton.	2 / 3
Actionability	Provides fully executable TypeScript with exact import paths, typed signatures, and a method reference table spelling out concrete semantics (e.g. 'canDelete with own:true + no item -> RETURNS FALSE'), which is copy-paste ready.	3 / 3
Workflow Clarity	Sequences are clearly numbered and CRITICAL gotchas are flagged, but destructive workflows (delete) rely on authorization gates rather than explicit validate/fix/retry feedback loops — 'steps listed but validation gaps; checkpoints missing or implicit'. Not a 3 because no verification checkpoint is given after the fetch/check, and not a 1 because the step order is explicit.	2 / 3
Progressive Disclosure	No bundle files exist (references/scripts/assets absent) and the body is a single ~373-line file with everything inline, including material (test matrices, admin-side matching) that could be split out — 'some structure but content that should be separate is inline'. Not a 3 because there are no one-level-deep external references to defer detail to.	2 / 3
	Total	9 / 12 Passed

Description

85%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description with an explicit trigger clause and a clearly bounded niche, weakened only by trigger terms that lean on internal API names rather than broadly natural user phrasings.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions and named API functions ('createPermissionSchema', 'createPermissionsAbstraction/createPermissionsFeature', 'checking read/write/delete/publish permissions', 'handling own-record scoping'), matching the 'lists multiple specific concrete actions' anchor.	3 / 3
Completeness	An explicit 'Use this skill when...' clause plus an enumerated list of triggers clearly answers both what it does and when to use it, matching the 'clearly answers both what AND when' anchor.	3 / 3
Trigger Term Quality	Trigger terms skew toward internal API surface names ('createPermissionsAbstraction', 'own-record scoping') which a Webiny-API engineer would say, but common natural variations (e.g. 'permission check', 'RBAC', 'authorization logic') are missing, fitting 'some relevant keywords but missing common variations'. Not a 3 because the keyword set is jargon-heavy rather than broadly natural.	2 / 3
Distinctiveness Conflict Risk	Scoped to API-feature authorization/use cases and explicitly distinct from the admin-side skill, giving a clear niche unlikely to conflict; voice is third-person with no first/second-person violation.	3 / 3
	Total	11 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: webiny/webiny-js
Path: skills/user-skills/api/permissions/SKILL.md
Commit: 484553b

Reviewed: about 13 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.