Name: webiny-api-security-catalog
Rating: 58.4 (1 reviews)
Author: webiny

Blog Docs Log in Get started

webiny-api-security-catalog

API — Security & Auth — 53 abstractions. Authentication, API keys, roles, users, teams event handlers and use cases.

Quality

67%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/user-skills/generated/api/security/SKILL.md

Quality

Content

77%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a well-structured, highly actionable catalog with copy-paste imports, source paths, and a clear usage workflow, but it is a monolithic ~390-line inline list with no progressive disclosure into reference files and considerable repetitive boilerplate.

Suggestions

Split the 53-entry catalog into per-domain reference files (e.g. references/api-keys.md, references/roles.md, references/users.md) and keep SKILL.md as an overview with clearly signaled links.

Collapse the repetitive event-handler boilerplate into a single stated pattern plus a compact table, rather than six near-identical blocks per lifecycle.

Resolve the duplicate 'ApiKeyFactory' entry (imported from both 'webiny/api/security/api-key' and 'webiny/api/security') and fill the missing descriptions for createPermissionsAbstraction/createPermissionSchema/createPermissionsFeature.

Dimension	Reasoning	Score
Conciseness	There is no padding with concepts Claude already knows and the 'How to Use' section is lean, but the ~390-line body repeats near-identical boilerplate across 53 entries (e.g. 'Hook into X lifecycle after Y is created/deleted/updated') that could be tightened into a table or a stated pattern.	2 / 3
Actionability	Each entry provides a copy-paste-ready import statement and a concrete source file path, and the 'How to Use' steps give a clear, executable next-step flow (find abstraction, read source, import, consult pattern skills), which is fully actionable for a reference catalog.	3 / 3
Workflow Clarity	The 'How to Use' section lays out an unambiguous 4-step sequence with an explicit checkpoint ('You MUST read the source file to get the exact interface and types'); this is a simple lookup workflow where that level of sequencing is sufficient.	3 / 3
Progressive Disclosure	There is some structure ('How to Use' plus an alphabetically organized list with a consistent per-entry format), but the entire 53-entry catalog is inline in SKILL.md with no bundle/reference files and no signaled navigation to split detail out, so content that could be separate is not.	2 / 3
	Total	10 / 12 Passed

Description

57%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description conveys a clear, distinctive niche and several relevant domain keywords, but it lacks any explicit 'when to use' trigger guidance and leans on internal jargon ('abstractions', 'event handlers and use cases') rather than natural user phrasing.

Suggestions

Add an explicit trigger clause, e.g. 'Use when working with Webiny API security, authentication, API keys, roles, users, or teams.'

Replace jargon like '53 abstractions' and 'event handlers and use cases' with concrete user-facing actions (e.g. 'hook into auth/api-key/role/user lifecycle events, run CRUD use cases').

State the concrete action the skill performs (e.g. 'Locate and import the correct security/auth abstraction') rather than only naming the domain.

Dimension	Reasoning	Score
Specificity	It names the domain ('API — Security & Auth') and lists several concrete categories ('Authentication, API keys, roles, users, teams event handlers and use cases'), but these are entity/area nouns rather than concrete actions and the catalog scope is asserted ('53 abstractions') rather than shown, so it is not comprehensive.	2 / 3
Completeness	It clearly answers 'what' (a catalog of security/auth abstractions) but provides no 'Use when...' or equivalent explicit trigger guidance for when Claude should invoke it, which caps completeness at 2.	2 / 3
Trigger Term Quality	Natural domain keywords like 'Authentication', 'API keys', 'roles', 'users', and 'teams' are present, but they are diluted by internal jargon ('53 abstractions', 'event handlers and use cases') and miss common trigger variations a user might say.	2 / 3
Distinctiveness Conflict Risk	The 'API — Security & Auth' framing carves out a clear, narrow niche within the webiny-api context that is unlikely to conflict with other skills.	3 / 3
	Total	9 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: webiny/webiny-js
Path: skills/user-skills/generated/api/security/SKILL.md
Commit: 484553b

Reviewed: about 12 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.