pentest-blackboard

CyberStrikeAI 项目黑板：跨会话 Fact 图（SQLite）+ upsert_project_fact/record_vulnerability 边渗透边记录节奏、关系边 links、confidence、与多代理协调落库。Use when managing project facts, blackboard index, writing evidence, or avoiding context-loss after compression.

Quality

71%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./skills/pentest-blackboard/SKILL.md

Quality

Content

71%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a dense, actionable instruction skill with concrete tool calls, data-structure conventions, and clear record-while-pentesting workflows including validation checkpoints. Its weakest dimension is progressive disclosure: everything is inlined in one file with no bundle references, despite being over 50 lines.

Suggestions

Move the detailed write-spec (fact_key/category rules, links schema, confidence gating) into a references/ file and keep SKILL.md as an overview with a one-level-deep pointer, improving progressive disclosure.

Tighten the redundancy between the '原语与分工' table and the '### Fact vs 漏洞' subsection to lift conciseness toward a 5.

Make validation checkpoints fully explicit (e.g., a numbered 'before recording: list_vulnerabilities → if duplicate, update; else record' checklist) to push workflow_clarity to a 5.

Dimension	Reasoning	Score
Conciseness	The body is dense and assumes Claude's competence (no explanations of pentesting, SQLite, or basic concepts), using compact tables throughout; minor redundancy (Fact-vs-vulnerability appears both in the table and its own subsection) keeps it just below a 5.	4 / 5
Actionability	Concrete and specific throughout — named tools, fact_key formats (target/primary_domain, finding/sqli-login), link structures ({from: target/*, type: discovered_on}), confidence values, and an explicit rejection→switch-path sequence — with only minor gaps versus copy-paste-ready precision.	4 / 5
Workflow Clarity	The '边渗透边记录' discipline gives a clear numbered sequence with checkpoints (立即 upsert on confirmed cognition, 立即 record on verified vulnerability, 查重 before recording) and feedback loops (rejection switch-path, search→verify→confirm gating); a few validation checkpoints are implicit rather than explicit, capping it at 4.	4 / 5
Progressive Disclosure	Section headers and tables give reasonable structure and companion skills (pentest-verification, component-vuln-intel, proxy-tool-bootstrap) are signaled inline, but all content lives in a single ~100-line file with no bundle files to split into, so it is more monolithic than a well-disclosed multi-file skill.	3 / 5
	Total	15 / 20 Passed

Description

71%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description clearly communicates a niche pentest blackboard skill with named tools and an explicit Use-when clause, achieving strong distinctiveness and good specificity. Its main weakness is trigger-term quality: the natural-language triggers are diluted by internal jargon and lack common synonyms.

Suggestions

Rewrite the 'Use when' clause in plain user-facing terms with synonyms a pentester would actually say (e.g., 'use when recording pentest findings, building an attack graph, persisting evidence across sessions, or recovering context after context compression').

Lead with the concrete capabilities a user cares about before the tool names, so the description reads as actions rather than API surface.

Add a couple of common-synonym trigger terms (e.g., 'pentest notes', 'attack graph', 'evidence log') to broaden natural-keyword coverage.

Dimension	Reasoning	Score
Specificity	Names concrete tools (upsert_project_fact, record_vulnerability) and concrete mechanisms (cross-session Fact graph in SQLite, links, confidence, multi-agent coordination) — several specific actions with only minor gaps, not quite comprehensive enough for a 5.	4 / 5
Completeness	Both 'what' (project blackboard, Fact graph, tools, links, confidence, coordination) and 'when' (explicit Use-when trigger phrases) are present; the 'when' is explicit but somewhat abstract/specialized rather than fully concrete user utterances, keeping it below a 5.	4 / 5
Trigger Term Quality	The 'Use when managing project facts, blackboard index, writing evidence, or avoiding context-loss after compression' clause supplies some natural triggers, but they are mixed with heavy jargon (Fact graph, 关系边 links, confidence) and miss common synonyms a user would naturally say.	3 / 5
Distinctiveness Conflict Risk	Tightly bound to a specific product niche (CyberStrikeAI project blackboard) with named tools (upsert_project_fact, record_vulnerability), giving it a clear niche and minimal conflict risk with other skills.	5 / 5
	Total	16 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
metadata_field	'metadata' should map string keys to string values	Warning

	Total	14 / 16 Passed

Repository: Ed1s0nZ/CyberStrikeAI
Path: skills/pentest-blackboard/SKILL.md
Commit: 893f134

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.