Name: webiny-api-security-catalog
Rating: 56.00000000000001 (1 reviews)
Author: webiny

Blog Docs Log in Get started

webiny-api-security-catalog

API — Security & Auth — 53 abstractions. Authentication, API keys, roles, users, teams event handlers and use cases.

Quality

62%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/user-skills/generated/api/security/SKILL.md

Quality

Content

71%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is an efficient, highly actionable reference catalog with exact imports and a clear lookup workflow, but it inlines ~390 lines that belong in a separate references file and has minor redundancy. Adding file-level progressive disclosure and grouping would meaningfully improve it.

Suggestions

Move the 53-entry abstraction catalog into a separate references/ file (e.g., references/abstractions.md) and keep SKILL.md as an overview with a clearly signaled one-level link, raising progressive_disclosure.

Group entries by category (Authentication, API Keys, Roles, Users, Teams, Permissions, Identity) with sub-headers for easier navigation.

Add a small executable usage example for at least one representative handler and one use case, and remove the duplicated ApiKeyFactory entry.

Dimension	Reasoning	Score
Conciseness	Each catalog entry is a terse Name/Import/Source/Description block with no over-explanation of concepts Claude knows, fitting the efficient score-4 anchor; it loses 5 only due to a duplicated ApiKeyFactory entry and a few entries missing a Description line.	4 / 5
Actionability	Every abstraction ships a copy-paste-ready import statement and an exact source path, giving mostly executable guidance per the score-4 anchor; it stops short of 5 because there are no concrete usage code examples beyond imports.	4 / 5
Workflow Clarity	The 'How to Use' section lays out a clear 4-step sequence including a mandatory checkpoint ('You MUST read the source file'), matching the score-4 anchor of a clear sequence with most checkpoints; it lacks error-recovery feedback loops so it does not reach 5.	4 / 5
Progressive Disclosure	No bundle files exist and the 53-entry catalog is inlined flat in SKILL.md with only one section header, matching the score-3 anchor of some structure present but content that would fit a separate references file is inline; it is above 2 because the intro and Abstractions header provide minimal navigation.	3 / 5
	Total	15 / 20 Passed

Description

53%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description clearly identifies its niche and lists relevant security/auth categories but lacks concrete action verbs and an explicit 'Use when' trigger clause, capping completeness at 3. It is distinctive but slightly generic in phrasing.

Suggestions

Add an explicit 'Use when...' clause stating when Claude should invoke this skill (e.g., 'Use when implementing Webiny security, auth, API keys, roles, users, or teams features').

Replace noun-only enumeration with concrete actions (e.g., 'create, list, update, delete API keys, roles, and users') to raise specificity.

Include natural trigger synonyms and file/package hints users would actually say to improve trigger-term coverage.

Dimension	Reasoning	Score
Specificity	The description names the domain ('API — Security & Auth') and enumerates sub-areas ('Authentication, API keys, roles, users, teams event handlers and use cases'), but lists noun categories rather than concrete actions like create/list/delete, matching the score-3 anchor of naming the domain with limited actions.	3 / 5
Completeness	It gives a clear 'what' (53 security/auth abstractions across listed categories) but no 'Use when...' trigger clause, so per the rubric cap it cannot exceed 3, matching the 'clear what, missing when' anchor.	3 / 5
Trigger Term Quality	It includes relevant domain keywords a Webiny developer would say ('API keys', 'roles', 'users', 'teams', 'Authentication'), but misses common synonyms and natural variations, fitting the score-3 anchor of some relevant keywords with missing variations.	3 / 5
Distinctiveness Conflict Risk	The 'API — Security & Auth — 53 abstractions' framing carves a clear Webiny-specific niche with distinct triggers and only minor overlap risk with adjacent webiny skills, fitting the mostly-distinct score-4 anchor rather than 3 (broader overlap) or 5 (fully disambiguated with explicit when).	4 / 5
	Total	13 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: webiny/webiny-js
Path: skills/user-skills/generated/api/security/SKILL.md
Commit: d98a4e8

Reviewed: 4 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.