gtfobins-validate

Validate shell builtins against GTFOBins attack patterns to ensure exploits are blocked by the sandbox

Quality

58%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

—

The risk profile of this skill

Fix and improve this skill with Tessl

tessl review fix ./.claude/skills/gtfobins-validate/SKILL.md

Quality

Content

77%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

This is a well-crafted security validation skill with excellent actionability and workflow clarity. The step-by-step process is thorough, with concrete Go test templates, explicit validation checkpoints, and a clear escalation path for critical findings. The main weaknesses are moderate verbosity (some redundancy between the classification table, known patterns section, and notes) and the monolithic structure that could benefit from splitting reference material into separate files.

Suggestions

Move the 'Known GTFOBins attack patterns for current builtins' section to a separate reference file (e.g., KNOWN_PATTERNS.md) to reduce the main skill's length and improve progressive disclosure.

Consolidate the Notes section into the Step 3 classification table to eliminate redundancy — the design constraints are already captured there.

Dimension	Reasoning	Score
Conciseness	The skill is reasonably efficient but includes some redundancy — the 'Known GTFOBins attack patterns' section partially duplicates what the workflow already covers, and the Notes section restates design constraints mentioned in the classification table. The security preamble is justified given the threat model but is somewhat lengthy.	2 / 3
Actionability	The skill provides fully executable Go test patterns, specific file paths, exact bash commands to run tests, concrete flag examples, and clear naming conventions. The test templates are copy-paste ready with only command-specific substitutions needed.	3 / 3
Workflow Clarity	The 6-step workflow is clearly sequenced with explicit validation checkpoints (Step 5: run tests and verify), a feedback loop for failures ('Fix any test failures'), and a critical findings escalation path that halts the process. The classification table in Step 3 provides clear decision criteria for each attack category.	3 / 3
Progressive Disclosure	The content is well-structured with clear sections, but it's a long monolithic document (~180 lines of content) with no references to external files for detailed content like the known attack patterns or test templates. The 'Known GTFOBins attack patterns' reference section could be split into a separate file, and no bundle files are provided to support progressive disclosure.	2 / 3
	Total	10 / 12 Passed

Description

40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description targets a clear and distinctive niche (GTFOBins validation for shell builtins), which makes it unlikely to conflict with other skills. However, it lacks a 'Use when...' clause, limiting Claude's ability to know when to select it, and could benefit from listing more concrete actions and natural trigger terms that users might employ when needing this capability.

Suggestions

Add an explicit 'Use when...' clause, e.g., 'Use when the user asks about GTFOBins, shell builtin security, privilege escalation via builtins, or sandbox escape validation.'

Include additional natural trigger terms such as 'privilege escalation', 'security audit', 'command injection', 'LOLBAS', or 'shell escape' to improve keyword coverage.

List more specific concrete actions, e.g., 'Checks shell builtins against known GTFOBins exploit patterns, reports vulnerable commands, and verifies sandbox restrictions block exploitation.'

Dimension	Reasoning	Score
Specificity	The description names a specific domain (shell builtins, GTFOBins attack patterns, sandbox) and a core action (validate/ensure exploits are blocked), but it doesn't list multiple concrete actions—it's essentially one action described with domain-specific terms.	2 / 3
Completeness	The description answers 'what' (validate shell builtins against GTFOBins patterns) but completely lacks a 'Use when...' clause or any explicit trigger guidance for when Claude should select this skill. Per the rubric, a missing 'Use when...' clause caps completeness at 2, and the 'when' is not even implied clearly, so it scores 1.	1 / 3
Trigger Term Quality	Includes relevant technical keywords like 'shell builtins', 'GTFOBins', 'sandbox', and 'exploits', which are terms a security-minded user might use. However, it misses common variations like 'privilege escalation', 'security audit', 'LOLBAS', or 'command injection' that users might naturally say.	2 / 3
Distinctiveness Conflict Risk	This is a very specific niche—GTFOBins attack pattern validation for shell builtins in a sandbox context. It is highly unlikely to conflict with other skills due to its narrow, specialized focus.	3 / 3
	Total	8 / 12 Passed

Validation

90%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 10 / 11 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	10 / 11 Passed

Repository: DataDog/rshell
Path: .claude/skills/gtfobins-validate/SKILL.md
Commit: 7518a70

Reviewed: 6 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.