CtrlK
BlogDocsLog inGet started
Tessl Logo

competition-oauth-oidc-chain

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for OAuth, OIDC, redirect flows, state or nonce handling, PKCE, token exchange, refresh logic, claim mapping, and accepted login paths. Use when the user asks to trace redirects, callback parameters, scopes, state, nonce, PKCE, refresh tokens, consent, or explain how an OAuth or OIDC chain turns into accepted identity or privilege. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.

72

Quality

91%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

High

Do not use without reviewing

SKILL.md
Quality
Evals
Security

Quality

Content

86%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A lean, well-structured instruction-only skill that gives concrete analysis checklists and cleanly offloads detail to a real one-level-deep reference. It falls just short of perfect actionability and workflow clarity by lacking a worked example and an explicit validation feedback loop.

Suggestions

Add one minimal worked example of a redirect-to-acceptance chain (entry -> redirect -> callback -> token exchange -> accepted identity) to lift actionability from concrete guidance to fully illustrative.

Insert an explicit verification checkpoint in the Workflow, e.g. after step 2 confirm the recorded evidence links a browser redirect to a backend token acceptance before reducing the chain.

Note in 'What To Preserve' how to detect and flag when the task drifts outside the auth chain, reinforcing the hand-off back to the broader web-runtime skill already mentioned in step 3.

DimensionReasoningScore

Conciseness

The ~47-line body assumes Claude knows OAuth/OIDC and PKCE, offering only task-specific instructions such as "Separate token possession from actual identity acceptance" with no concept padding, so every token earns its place.

5 / 5

Actionability

Concrete checklists ("Record scopes, state, nonce, PKCE material, redirect URIs, and claim-bearing tokens") and a real pointer to references/oauth-oidc-chain.md give actionable guidance, but no worked example of an actual chain trace leaves a minor gap versus fully executable coverage.

4 / 5

Workflow Clarity

A numbered Quick Start plus a three-stage Workflow sequence with checkpoints ("Record... before mutating anything", "Reproduce the smallest redirect-to-acceptance flow that proves the decisive identity edge") is clear, but there is no explicit validate-fix-retry feedback loop, capping it below 5.

4 / 5

Progressive Disclosure

Well-organized sections (Quick Start, Workflow, Read This Reference, What To Preserve) with a single clearly signaled one-level-deep reference to references/oauth-oidc-chain.md, which exists and holds the detailed checklists, matching the top anchor.

5 / 5

Total

18

/

20

Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A highly specific, well-triggered description that clearly states both what it does and when to use it, with strong distinctiveness via explicit downstream-routing constraints. The only minor gap is a few missing natural synonyms in the trigger terms.

DimensionReasoningScore

Specificity

Enumerates many concrete actions across the domain — "OAuth, OIDC, redirect flows, state or nonce handling, PKCE, token exchange, refresh logic, claim mapping, and accepted login paths" — giving comprehensive coverage rather than vague abstractions.

5 / 5

Completeness

Explicitly answers what ("CTF-sandbox workflow for OAuth, OIDC...") and when ("Use when the user asks to trace redirects...") with concrete trigger phrases, matching the top anchor.

5 / 5

Trigger Term Quality

"Use when the user asks to trace redirects, callback parameters, scopes, state, nonce, PKCE, refresh tokens, consent" gives good natural keyword coverage, but common synonyms like SSO, login flow, or authorization code are absent, stopping short of a 5.

4 / 5

Distinctiveness Conflict Risk

"Internal downstream skill for ctf-sandbox-orchestrator" and "Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here" carve a clear niche with explicit routing, minimizing conflict risk.

5 / 5

Total

19

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
zhaoxuya520/reverse-skill
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.