CtrlK
BlogDocsLog inGet started
Tessl Logo

webiny-api-permissions

Schema-based permission system for API features. Use this skill when implementing authorization in use cases, defining permission schemas with createPermissionSchema, creating injectable permissions via createPermissionsAbstraction/createPermissionsFeature, checking read/write/delete/publish permissions, handling own-record scoping, or testing permission scenarios. Covers the full pattern from schema definition to use case integration to test matrices.

68

Quality

83%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

78%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-structured skill body with executable code and clear layered workflow, weakened mainly by length/repetition and a lack of progressive disclosure into reference files. The promised test matrices are missing.

Suggestions

Move the method-reference table and the per-use-case implementation templates into a references/ file (e.g. USE_CASES.md), keeping SKILL.md as a concise overview with one-level-deep pointers, to improve progressive_disclosure and conciseness.

Add the 'test matrices' the description promises — a concrete permission×scope×action matrix showing expected canRead/canEdit/canDelete outcomes — or drop the claim from the description.

Trim repetition of the canDelete-without-item gotcha to a single authoritative callout (e.g. the Gotchas entry) and reference it from the Delete use case rather than restating it.

DimensionReasoningScore

Conciseness

Information-dense with no basic-concept padding and copy-paste code throughout, but ~360 lines with five full use-case classes includes some repetition (e.g., the canDelete gotcha restated across the table, use case, and Gotchas section) that could be trimmed.

4 / 5

Actionability

Fully executable, copy-paste-ready TypeScript for schema, abstraction, feature, registration, and every CRUD use case, plus a method reference table and OwnableItem interface — specific examples cover the common cases.

5 / 5

Workflow Clarity

Clear layered sequence (Layer 1 schema → Layer 2 features → registration → use cases) with numbered checkpoints inside each use case and fail-fast Result.fail guards; the destructive delete path correctly fetches-then-checks, but there are no explicit validate→fix→retry feedback loops.

4 / 5

Progressive Disclosure

Well-organized with clear headers, but all content (method reference, five full use-case implementations, gotchas) is inlined in a 360-line SKILL.md with no bundle files or one-level-deep reference pointers, and the description's promised 'test matrices' are absent.

3 / 5

Total

16

/

20

Passed

Description

88%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that answers both what and when with concrete trigger phrases and named APIs. Minor room for improvement in trigger-term synonyms and distinguishing from the sibling admin-permissions skill.

DimensionReasoningScore

Specificity

Lists multiple concrete actions tied to named APIs — 'defining permission schemas with createPermissionSchema', 'creating injectable permissions via createPermissionsAbstraction/createPermissionsFeature', 'checking read/write/delete/publish permissions', 'handling own-record scoping', 'testing permission scenarios' — giving comprehensive coverage of the skill's capabilities.

5 / 5

Completeness

Explicitly states what ('Schema-based permission system for API features') and when ('Use this skill when implementing authorization in use cases...') with concrete trigger phrases covering the full pattern from schema to test matrices.

5 / 5

Trigger Term Quality

Includes natural domain terms a user would say ('implementing authorization', 'checking read/write/delete/publish permissions', 'own-record scoping') plus API names, but lacks synonyms or variants beyond the core permission vocabulary.

4 / 5

Distinctiveness Conflict Risk

The 'Schema-based permission system for API features' framing plus webiny-specific API names carve a clear API-side niche, with only minor overlap risk against the related admin-side permissions skill.

4 / 5

Total

18

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
webiny/webiny-js
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.