CtrlK
BlogDocsLog inGet started
Tessl Logo

testland/keycloak-tests

Authors and runs integration tests against Keycloak - uses Testcontainers Keycloak module to spin up an isolated server per test class, imports realm JSON for fixtures, exercises OIDC discovery / token endpoint / token introspection / admin REST API; tests password / authorization-code / client-credentials / token-exchange flows; covers UMA (User-Managed Access) permission tickets. Use when the user works with self-hosted Keycloak and needs unit / integration tests for realms, clients, users, or auth flows.

75

Quality

94%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Low

Low-risk findings worth noting

Overview
Quality
Evals
Security
Files

Quality

Content

85%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, highly actionable test-authoring skill with real executable code, a clear sequenced workflow, and proper one-level progressive disclosure. The main weakness is mild verbosity from quoted concept definitions and some redundancy between the How-to-use preview, the steps, and the worked example.

Suggestions

Trim the Overview quotes defining 'realm' and 'client' — Claude already knows these Keycloak concepts — or replace them with a one-line orientation that links to kc-admin.

Remove the 'How to use' numbered preview or the 'Worked example' section; both restate Steps 1-8 and add redundancy rather than new guidance.

Inline a minimal token-introspection code block in Step 5 (mirroring Step 3/4) so the promised introspection flow is executable in-body rather than only via the reference file.

DimensionReasoningScore

Conciseness

Mostly code-first and lean, but includes concept explanations Claude already knows (quoted 'A realm manages a set of users...' / 'Clients are entities...' definitions) and redundancy — the 'How to use' preview re-states the Step 1–8 headers and the 'Worked example' rehashes Steps 1-2, 4, 5, 8; not a 3 because not every token earns its place, not a 1 because it is not padded prose overall.

2 / 3

Actionability

Provides fully executable, copy-paste-ready code — the session-scoped Testcontainers fixture, the password/client-credentials token POSTs with real URLs and params, the jq secret-stripping pipeline, the CI yaml, plus a pinned image tag quay.io/keycloak/keycloak:25.0; not a 2 because the code present is real and runnable rather than pseudocode, with deferred introspection/admin detail living in a real reference file.

3 / 3

Workflow Clarity

Clear 8-step sequence mirrored by a 'How to use' summary, with validation embedded as test assertions (assert response.status_code == 200) and an Anti-patterns table acting as a checklist; not a 2 because checkpoints are explicit in code rather than missing, and the destructive/batch cap does not apply to test authoring.

3 / 3

Progressive Disclosure

Well-organized sections with one-level-deep, clearly signaled references — Steps 5 and 7 link to references/endpoint-recipes.md, which exists as a real file — and a References section for external docs; not a 2 because navigation is clear and references are not deeply nested.

3 / 3

Total

11

/

12

Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description: third-person voice, dense with specific concrete actions, explicit 'Use when' triggers, and a clearly distinct Keycloak-testing niche. No first/second-person voice to penalize.

DimensionReasoningScore

Specificity

Enumerates many concrete actions — 'Authors and runs integration tests', 'uses Testcontainers Keycloak module to spin up an isolated server per test class', 'imports realm JSON for fixtures', 'exercises OIDC discovery / token endpoint / token introspection / admin REST API', 'tests password / authorization-code / client-credentials / token-exchange flows', 'covers UMA permission tickets' — matching the multiple-specific-actions anchor; not a 2 because it goes well beyond naming a domain and a few actions.

3 / 3

Completeness

Explicitly answers both what ('Authors and runs integration tests... exercises OIDC endpoints...') and when via an explicit 'Use when the user works with self-hosted Keycloak and needs unit / integration tests for realms, clients, users, or auth flows.' clause; not a 2 because the trigger guidance is explicit, not merely implied.

3 / 3

Trigger Term Quality

Uses natural terms a Keycloak user would actually say — 'Keycloak', 'self-hosted Keycloak', 'realms, clients, users', 'auth flows', 'integration tests' — giving good coverage rather than just jargon; not a 2 because common variations are present rather than missing.

3 / 3

Distinctiveness Conflict Risk

Carves a clear Keycloak-specific niche ('self-hosted Keycloak', Testcontainers-per-class) unlikely to trigger for generic auth or other IdP skills; not a 2 because the 'self-hosted Keycloak' trigger is distinct rather than broadly overlapping.

3 / 3

Total

12

/

12

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Reviewed

Table of Contents