pentest-verification

验证铁律:搜索≠漏洞,confirmed Fact须证据,tentative表线索,禁止空泛推测,负结果也落库, 想象力拉满+单步验证零容忍。Use when writing project facts, validating findings, or avoiding hallucination.

Quality

90%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

87%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A tight, actionable rule-set that names specific tools and verification checkpoints with excellent conciseness and progressive disclosure. Its main gap is that the rules are parallel principles rather than an explicitly sequenced workflow, leaving the decision flow implicit.

Suggestions

Add a short ordered decision flow (e.g., 1. find lead → 2. verify with evidence → 3. confirmed Fact or tentative/negative Fact) so the workflow is sequenced, not just parallel rules.

Include one concrete example of a well-formed confirmed Fact body and a negative-result Fact call to make the upsert_project_fact / record_vulnerability usage copy-paste ready.

Dimension	Reasoning	Score
Conciseness	The body is a lean ~12 lines of dense rules with no padding or explanation of concepts Claude already knows. It is not anchor 2 because there is no unnecessary explanation to tighten; nearly every token is a directive.	3 / 3
Actionability	Directives name concrete tools and fields (record_vulnerability, confidence=confirmed, tentative, upsert_project_fact) and specific evidence types (命令输出/HTTP响应/文件内容/回连记录), with an inline example '测了XX,无可利用漏洞'. It is not anchor 2 because guidance references exact tool calls and evidence requirements rather than abstract description.	3 / 3
Workflow Clarity	Verification checkpoints are explicit (evidence required before confirmed; failed verification writes a negative Fact to prevent retry), but the rules are parallel principles rather than a clearly sequenced procedure. It is not anchor 3 because there is no ordered step-by-step workflow, and not anchor 1 because validation checkpoints are present.	2 / 3
Progressive Disclosure	Under 50 lines, well-organized into one titled section with numbered rules, and includes a one-level signaled reference to pentest-blackboard for tool alignment. It is not anchor 2 because content is appropriately compact and the single reference is clearly signaled rather than buried.	3 / 3
	Total	11 / 12 Passed

Description

92%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A concise, concrete description that clearly states both capability and trigger conditions, with strong specificity and completeness. Its main weakness is that the English trigger terms are somewhat generic and could overlap with general anti-hallucination or fact-management skills.

Suggestions

Tie the 'Use when' triggers more explicitly to the pentest/blackboard context (e.g., 'Use when recording penetration-test findings or validating exploit evidence') to reduce overlap with general fact-management skills.

Replace slogan-like phrases ('想象力拉满', '零容忍') in the description with one more concrete capability verb to keep specificity purely action-based.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions rather than vague language: '搜索≠漏洞', 'confirmed Fact须证据', 'tentative表线索', '负结果也落库', '单步验证零容忍'. It is not anchor 2 because it enumerates several specific behaviors, not just naming a domain with partial actions.	3 / 3
Completeness	Explicitly answers what (the verification rules '验证铁律') and when ('Use when writing project facts, validating findings, or avoiding hallucination'). It is not anchor 2 because an explicit trigger clause is present alongside the capability statement.	3 / 3
Trigger Term Quality	Explicit 'Use when writing project facts, validating findings, or avoiding hallucination' covers several natural trigger phrases a user would voice. It is not anchor 2 because multiple relevant triggers are present rather than a single keyword missing common variations.	3 / 3
Distinctiveness Conflict Risk	The pentest-specific tooling context (record_vulnerability, upsert_project_fact, pentest-blackboard) gives it a niche, but English triggers like 'avoiding hallucination' and 'writing project facts' could overlap with general fact-management skills. It is not anchor 3 because the trigger phrasing is not uniquely pentest-scoped, and not anchor 1 because the domain and tools are clearly specialized.	2 / 3
	Total	11 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: Ed1s0nZ/CyberStrikeAI
Path: skills/pentest-verification/SKILL.md
Commit: dad14c5

Reviewed: about 15 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.