CtrlK
BlogDocsLog inGet started
Tessl Logo

gtfobins-validate

Validate shell builtins against GTFOBins attack patterns to ensure exploits are blocked by the sandbox

52

Quality

58%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./.claude/skills/gtfobins-validate/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

70%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a well-sequenced, actionable workflow with strong validation checkpoints, though it is mildly redundant and keeps reference data inline rather than splitting it into a bundled reference file.

Suggestions

Move the "Known GTFOBins attack patterns for current builtins" reference data into a bundled reference file (e.g. references/gtfobins-patterns.md) and link to it, reducing inline length.

Trim redundancy between the Step 3 classification table and the final "Notes" section, which repeat the "blocked by design" reasoning.

Consider collapsing or shortening the per-category test-pattern examples since the naming convention and one canonical example already convey the pattern.

DimensionReasoningScore

Conciseness

Mostly efficient with concrete code, but the "Known GTFOBins attack patterns" and "Notes" sections restate techniques already implied by the classification table, adding some redundant explanation.

3 / 5

Actionability

Provides executable Go test patterns, specific file paths, naming conventions, and a runnable `go test` command; minor gaps remain where placeholders like `<command>` must be substituted.

4 / 5

Workflow Clarity

A clear 6-step sequence with explicit validation in Step 5 (run tests, fix failures) and a feedback loop in the critical-findings section (stop, report, fix, re-run), which matches the top anchor.

5 / 5

Progressive Disclosure

Good section headers, but no bundle files exist and all content (including the inline "Known GTFOBins attack patterns" reference data that could live in a separate file) is inlined in one ~170-line SKILL.md.

3 / 5

Total

15

/

20

Passed

Description

46%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description conveys a clear, specific purpose but lacks any "Use when..." trigger guidance and leans on technical jargon rather than natural user phrasing. It is distinct but not maximally discoverable.

Suggestions

Add an explicit "Use when..." clause, e.g. "Use when hardening the shell against GTFOBins attack patterns or auditing builtin security."

Include natural trigger terms a user might say (e.g. "sandbox escape", "builtin security", "GTFOBins audit") rather than only technical labels.

List 1-2 more concrete actions (e.g. "write pentest tests", "report exploitable techniques") to raise specificity.

DimensionReasoningScore

Specificity

Names the domain ("shell builtins", "GTFOBins attack patterns") and a concrete action ("Validate... to ensure exploits are blocked"), but covers only one action and is not comprehensive.

3 / 5

Completeness

The description gives a clear "what" but provides no "when"/"Use when..." guidance, which caps completeness at 3 per the judging guidelines.

3 / 5

Trigger Term Quality

Uses technical jargon ("GTFOBins", "shell builtins", "sandbox", "exploits") rather than natural phrases a user would actually say when needing this skill; no "Use when..." trigger phrasing.

2 / 5

Distinctiveness Conflict Risk

The niche is clear and specific (GTFOBins validation for a shell), with only minor overlap risk against generic security/audit skills.

4 / 5

Total

12

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository
DataDog/rshell
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.