authentication-patterns

Authentication patterns: session vs JWT vs OAuth comparison, provider selection (NextAuth, Clerk, Supabase Auth), security checklist, and common mistakes. Use when implementing auth, reviewing auth flows, or choosing auth providers.

Quality

85%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

78%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A dense, actionable reference with strong code examples and concrete thresholds. It is held back mainly by monolithic inline content with no progressive disclosure into separate reference files.

Suggestions

Split the detailed provider setup code and JWT best-practice details into reference files (e.g. PROVIDERS.md, JWT.md) referenced one level deep from SKILL.md to improve progressive disclosure.

Add an explicit validation/feedback loop for the security checklist (e.g. 're-run checklist, fix findings, re-check before shipping') to strengthen workflow clarity.

Trim the ASCII token-lifecycle diagram and storage-comparison table, or move them to a reference, to tighten conciseness further.

Dimension	Reasoning	Score
Conciseness	Mostly lean tables and P0/P1/P2 rules with no padding explaining basic concepts, though the ASCII token-lifecycle diagram and storage-comparison table add length that could be trimmed slightly.	4 / 5
Actionability	Provides copy-paste-ready TypeScript for NextAuth setup, bcrypt, and argon2 hashing, plus concrete thresholds (15-min access tokens, cost 12+, 5-10 attempts/min) covering the common cases.	5 / 5
Workflow Clarity	The decision guide and pre-shipping SECURITY_CHECKLIST sequence the work with checkpoints, but the reference-style body lacks an explicit validate->fix->retry feedback loop.	4 / 5
Progressive Disclosure	Content is well-organized with clear headers, but ~160 lines are entirely inline in SKILL.md with no bundle files or external references; provider setup code and detailed examples that could be split out are inlined.	3 / 5
	Total	16 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description with explicit 'what' and 'when' coverage and concrete trigger phrases. The only minor gap is a lack of common synonyms (login, SSO) among the trigger terms.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions (session vs JWT vs OAuth comparison, provider selection of NextAuth/Clerk/Supabase Auth, security checklist, common mistakes) with named providers, giving comprehensive coverage.	5 / 5
Completeness	Explicitly answers both 'what' (comparison, provider selection, checklist, mistakes) and 'when' via a clear 'Use when implementing auth...' clause with concrete trigger phrases.	5 / 5
Trigger Term Quality	Natural trigger phrases ('implementing auth', 'reviewing auth flows', 'choosing auth providers') are present, but common synonyms like 'login', 'authentication', or 'SSO' are missing.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear auth-patterns niche with distinct triggers and named providers, giving minimal overlap risk with other skills.	5 / 5
	Total	19 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: zebbern/claude-code-guide
Path: skills/authentication-patterns/SKILL.md
Commit: 59c5fc4

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.