CtrlK
BlogDocsLog inGet started
Tessl Logo

blockchain-contract-attack

区块链/智能合约:Etherscan,slither/mythril,重入/访问控制/预言机/闪电贷,跨链桥,RPC暴露。Use when auditing smart contracts, DeFi, or blockchain attack surfaces.

53

Quality

61%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Medium

Suggest reviewing before use

Fix and improve this skill with Tessl

tessl review fix ./skills/blockchain-contract-attack/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

47%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly token-efficient but functions as a dense keyword list rather than actionable guidance: no runnable commands, no sequenced workflow with validation, and no file structure to navigate.

Suggestions

Add concrete, copy-paste-ready commands for the named tools (e.g. an Etherscan getsourcecode API call and a slither CLI invocation) instead of listing only tool names.

Sequence the auditing workflow into numbered steps with validation checkpoints (run slither -> review findings -> confirm with manual check) so the destructive/batch nature is guarded.

Split the dense block into section headers (源码审计 / DeFi / 跨链桥 / RPC) or move detail into reference files so the overview is navigable.

DimensionReasoningScore

Conciseness

The body is a lean bullet-style attack-surface list with no padding or explanation of concepts Claude already knows; every token earns its place.

5 / 5

Actionability

It names tools (Etherscan, slither/mythril/manticore) and attack classes but gives no executable commands, code, or concrete steps to run them, leaving only high-level hints.

2 / 5

Workflow Clarity

Rough categorization is present but there is no sequenced workflow and no validation checkpoints for an inherently destructive/batch-oriented attack skill, so the destructive-operation cap is not even reached.

2 / 5

Progressive Disclosure

The body is a single monolithic code block with no section headers, navigation, or referenced bundle files (none exist), so structure and discoverability are minimal.

2 / 5

Total

11

/

20

Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and well-targeted, naming concrete tools and attack surfaces alongside an explicit trigger clause. It is slightly held back by generic trigger phrasing and missing synonyms rather than any vagueness.

DimensionReasoningScore

Specificity

Names the domain and lists several concrete tools and attack vectors (Etherscan, slither/mythril/manticore, reentrancy, access control, oracle, flash loan, cross-chain bridge, RPC暴露), with only minor coverage gaps.

4 / 5

Completeness

Both a clear 'what' (tools and attack surfaces) and an explicit 'Use when' trigger are present, with the 'when' slightly generic rather than fully concrete.

4 / 5

Trigger Term Quality

'Use when auditing smart contracts, DeFi, or blockchain attack surfaces' gives good natural keyword coverage, though a few common synonyms and file extensions are missing.

4 / 5

Distinctiveness Conflict Risk

It carves a clear blockchain/smart-contract attack niche with distinct triggers, with only minor overlap risk against general penetration-testing skills.

4 / 5

Total

16

/

20

Passed

Validation

87%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation14 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

metadata_field

'metadata' should map string keys to string values

Warning

Total

14

/

16

Passed

Repository
Ed1s0nZ/CyberStrikeAI
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.