identity-federation

Use for authorized assessment of federated identity systems including SAML, OIDC, OAuth2 flows, SSO misconfiguration, and token confusion issues.

Quality

69%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/identity-federation/SKILL.md

Quality

Content

68%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a token-efficient, well-structured overview with a real companion checklist file, but it stops at checklist-level guidance without executable commands and relies on a final self-check rather than inline validation checkpoints for risky operations.

Suggestions

Add one or two executable command snippets (e.g., a curl/.well-known/openid-configuration fetch or a SAML Raider assertion-edit step) to lift actionability above checklist-level guidance.

Insert an inline validation checkpoint after the collection and signature-check steps (e.g., 'confirm signature covers the full assertion before mutating it') instead of only a final self-check, to satisfy the destructive/batch workflow cap.

Render the 参考 section references as signaled markdown links (e.g., [sso-flow-checklist.md](references/sso-flow-checklist.md)) so the one-level-deep references are clearly navigable.

Dimension	Reasoning	Score
Conciseness	The body is a lean set of checklists, a compact tool table, and short operational sections with no concept padding (it never explains what SAML or PKCE is), assuming Claude's competence so that every token earns its place, matching the 5 anchor.	5 / 5
Actionability	It names specific checks ('redirect_uri 精确匹配、state 绑定、PKCE', '签名覆盖范围、algorithm 降级') and concrete targets ('/.well-known/openid-configuration'), but provides no executable code or commands, leaving key execution details missing as in the 3 anchor.	3 / 5
Workflow Clarity	A clear sequence exists (NOW/NEXT/ACT plus the ordered workflow boxes) with a final self-check, but operations carry real account-lockout risk, the validation is only an end-of-process checklist rather than inline checkpoints, and the destructive/batch cap holds this at 3.	3 / 5
Progressive Disclosure	The skill is under 50 lines with well-organized sections and one real one-level-deep reference (references/sso-flow-checklist.md, verified to exist), but references are listed as plain paths rather than clearly signaled links, matching 'good structure, references mostly clear, minor organization gaps' rather than 5.	4 / 5
	Total	15 / 20 Passed

Description

70%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and trigger-rich for a security audience, with an explicit 'Use for' clause covering both what and when. Its main limitation is a single generic action verb ('assessment') and minor overlap with JWT/api-security skills via 'token confusion'.

Dimension	Reasoning	Score
Specificity	The only action verb is the generic 'assessment', but the domain is richly enumerated with concrete targets ('SAML, OIDC, OAuth2 flows, SSO misconfiguration, and token confusion issues'), placing it between the 'minimal actions' (2) and '1-2 concrete actions' (3) anchors; the comprehensive domain listing pulls it up to 3.	3 / 5
Completeness	'Use for authorized assessment of...' supplies an explicit when-trigger and the enumerated list answers what, satisfying both halves; the when is blended into the what rather than cleanly separated as in the 5 anchor, so it sits at 4.	4 / 5
Trigger Term Quality	'SAML', 'OIDC', 'OAuth2', 'SSO misconfiguration', and 'token confusion' are exactly the natural terms a security tester would say, but common synonyms (Single Sign-On, OpenID Connect) are absent, matching the 'good coverage, a few natural terms missing' anchor rather than 5.	4 / 5
Distinctiveness Conflict Risk	It carves a clear federation/SSO niche with distinct protocol triggers, but 'token confusion issues' creates minor overlap with a JWT/api-security skill, matching 'mostly distinct; minor overlap risk' rather than the minimal-conflict 5 anchor.	4 / 5
	Total	15 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: zhaoxuya520/reverse-skill
Path: skills/identity-federation/SKILL.md
Commit: 3ae5c59

Reviewed: ~2 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.