CtrlK
BlogDocsLog inGet started
Tessl Logo

auth-implementation-patterns

Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems. Use when implementing auth systems, securing APIs, or debugging security issues.

54

Quality

60%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./plugins/developer-essentials/skills/auth-implementation-patterns/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

32%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a concept-heavy overview that re-explains fundamentals Claude already knows and delegates all executable content to a single reference file, yielding weak conciseness and actionability. Structure and progressive disclosure are reasonable, but no validation-backed workflow is present.

Suggestions

Replace the "Core Concepts" explanations of AuthN/AuthZ and the session/token/OAuth definitions with a brief assumption-of-knowledge summary, or move them to references/details.md to reduce padding.

Add at least one minimal executable snippet (e.g., a JWT verify middleware or bcrypt hashing call) inline so the overview itself is actionable, not just a pointer.

Provide a short sequenced workflow with a validation checkpoint for at least one risky operation (e.g., auth migration: verify token rotation, confirm session invalidation, test before cutover).

DimensionReasoningScore

Conciseness

The "Core Concepts" section extensively restates basics Claude already knows ("Authentication (AuthN): Who are you?", definitions of session vs token vs OAuth), and best-practice/pitfall bullets are padded restatements rather than new information.

2 / 5

Actionability

The body contains no executable code or concrete commands — only conceptual bullets and high-level directives ("Always hash with bcrypt/argon2") — with all runnable guidance delegated to references/details.md, leaving the overview itself non-instructive beyond hints.

2 / 5

Workflow Clarity

There is no sequenced multi-step workflow: "When to Use" lists triggers, "Best Practices" is an unordered checklist, and auth operations (destructive/batch) lack any validation checkpoint or feedback loop.

2 / 5

Progressive Disclosure

A single one-level-deep reference (references/details.md) is clearly signaled ("Read that file when the navigation tier above is insufficient") and the body is organized into well-headed sections, with only minor gaps in explicit pointer formatting.

4 / 5

Total

10

/

20

Passed

Description

87%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is strong: it states concrete capabilities and provides an explicit, natural-language "Use when" trigger clause covering multiple scenarios. Minor gains are possible by adding a few more discrete action verbs and synonyms.

DimensionReasoningScore

Specificity

Names concrete patterns ("JWT, OAuth2, session management, and RBAC") and a concrete outcome ("build secure, scalable access control systems"), but the lead verbs ("Master", "build") are somewhat high-level rather than enumerating several discrete actions, keeping it below the comprehensive 5 anchor.

4 / 5

Completeness

Explicitly states both what it does ("Master authentication and authorization patterns...") and when to use it via a concrete "Use when implementing auth systems, securing APIs, or debugging security issues" clause, matching the top anchor.

5 / 5

Trigger Term Quality

Natural phrases a user would say ("implementing auth systems", "securing APIs", "debugging security issues") plus specific tokens (JWT, OAuth2, RBAC) give good coverage, though some common synonyms (login, authentication tokens) are absent.

4 / 5

Distinctiveness Conflict Risk

Occupies a clear niche (auth/authz implementation patterns) with distinct, specific triggers and minimal overlap with unrelated skills.

5 / 5

Total

18

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
wshobson/agents
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.