CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

auth-implementation-patterns

Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems. Use when implementing auth systems, securing APIs, or debugging security issues.

61

0.96x
Quality

71%

Does it follow best practices?

Impact

96%

0.96x

1 of 3 eval scenarios. Add 2 more for a full score.

SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./plugins/developer-essentials/skills/auth-implementation-patterns/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

51%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The skill is well structured with excellent progressive disclosure — a lean overview correctly deferring worked examples to a verified, one-level-deep reference file. Its weaknesses are the absence of any explicit implementation workflow with validation checkpoints, and a Core Concepts section that re-teaches fundamentals Claude already knows.

Suggestions

Add an explicit sequenced workflow for the main use cases (e.g., implementing auth: 1. pick a strategy from Core Concepts, 2. follow the worked patterns in references/details.md, 3. validate against the Best Practices checklist, 4. check Common Pitfalls before finishing), with validation checkpoints.

Inline one small executable snippet (e.g., bcrypt hashing or JWT verification with expiry) in the body so the top level is actionable on its own, not just declarative guidance.

Cut or relocate the 'Core Concepts' primer (AuthN vs AuthZ, session/token/OAuth2 basics) — Claude already knows these fundamentals; keep only the strategy-selection guidance and move any needed detail into references/details.md.

DimensionReasoningScore

Conciseness

The Best Practices and Common Pitfalls sections are tight, actionable bullets, but the 'Core Concepts' section re-explains AuthN vs AuthZ and session-vs-token-vs-OAuth2 basics that Claude already knows — mostly efficient with one padded section, matching anchor 3 rather than 2 (only that single section is unnecessary) or 4 (that section should be trimmed or moved).

3 / 5

Actionability

Some guidance is concrete (bcrypt/argon2, '15-30 minutes max', httpOnly/secure/sameSite flags), but the body contains no executable code, commands, or implementation steps — all worked examples are delegated to references/details.md. This is 'some concrete guidance but incomplete', not anchor 4's 'concrete code or commands with minor gaps'.

3 / 5

Workflow Clarity

No explicit sequence exists for any supported task (implementing, migrating, debugging) — sections imply a reading order (when-to-use, concepts, details, practices, pitfalls) but steps are poorly defined and there are no validation checkpoints, matching anchor 2; it is above anchor 1 because the implicit progression is coherent, not missing.

2 / 5

Progressive Disclosure

The body is a well-organized overview with a clearly signaled, one-level-deep reference ('Detailed pattern documentation lives in `references/details.md`. Read that file when the navigation tier above is insufficient'), and the bundle check confirms details.md is a real, substantive 560-line file of worked patterns with no further nested references — content appropriately split and easy to navigate.

5 / 5

Total

13

/

20

Passed

Description

78%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description that explicitly covers both capability and trigger guidance with natural, domain-specific keywords. Its main weakness is generic action phrasing — it enumerates topics (JWT, OAuth2, sessions, RBAC) rather than concrete actions the skill performs.

DimensionReasoningScore

Specificity

The description names the domain and enumerates four concrete pattern objects ('JWT, OAuth2, session management, and RBAC'), but the action verbs are generic ('Master... to build secure, scalable access control systems') — it lists topics rather than several specific actions, matching anchor 3; it is well above anchor 2 because the enumerated technologies make the scope concrete.

3 / 5

Completeness

It explicitly answers both what ('Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems') and when ('Use when implementing auth systems, securing APIs, or debugging security issues') with concrete trigger phrases, matching the anchor-5 example pattern.

5 / 5

Trigger Term Quality

Phrases like 'implementing auth systems', 'securing APIs', and 'debugging security issues' plus keywords JWT and OAuth2 are terms users would naturally say. It falls short of anchor 5 because common synonyms such as login, SSO, permissions, or social login are absent.

4 / 5

Distinctiveness Conflict Risk

The auth/authz niche is clear with distinct triggers, but 'securing APIs' and 'debugging security issues' are broad enough to overlap with general API-security or security-review skills — minor overlap risk with closely related skills, matching anchor 4.

4 / 5

Total

16

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

wshobson/agents

Path

plugins/developer-essentials/skills/auth-implementation-patterns/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.