zero-day-discovery

0day自主发现引擎:变体分析/补丁间隙/差分/Fuzzing/污点推理/N-day武器化/猎人思维。Use when public vulns not found and need to discover 0day or weaponize N-day.

Quality

57%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./skills/zero-day-discovery/SKILL.md

Quality

Content

47%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body packs a lot of relevant domain knowledge and tool names into a compact block, but it is a monolithic wall of text with no executable code, no workflow checkpoints/validation, and no file-based structure or navigation.

Suggestions

Break the monolithic code block into headed sections (## Variant analysis, ## Patch gap, ## Fuzzing, ## Taint inference, ## N-day weaponization) and split deep methodology into separate reference files (e.g. FUZZING.md, CODEQL-QUERIES.md).

Add executable scaffolding: a minimal libFuzzer/AFL++ harness skeleton, a sample CodeQL/Semgrep query, and a bindiff workflow command sequence so guidance is copy-paste ready.

Add explicit validation checkpoints in the N-day weaponization and variant-analysis workflows (e.g. 'reproduce PoC locally → confirm crash is the target root cause → only then target'), with a fix→retry loop, to lift workflow clarity above 3.

Dimension	Reasoning	Score
Conciseness	The body is a dense, compact bullet list that assumes Claude's competence and avoids restating basic concepts, though the prose-style monospaced block and some explanatory asides ('红队最值钱能力之一') add minor padding.	4 / 5
Actionability	It names concrete tools (AFL++/libFuzzer, boofuzz, radamsa, restler, CodeQL, Semgrep, Joern, bindiff/diaphora) and concrete approaches, but provides no executable code, harness skeletons, CodeQL/Semgrep query snippets, or copy-paste commands — it describes rather than instructs.	3 / 5
Workflow Clarity	The five paths are enumerated but not sequenced into a runnable procedure, and for destructive/risky operations (exploit dev, weaponization) there is no validation/checkpoint loop — only a final '0day验证' criteria list with no 'validate → fix → retry' loop, leaving steps poorly defined.	2 / 5
Progressive Disclosure	The entire skill is a single monolithic inline code block with no section headers, no navigation, and no references to separate files; detailed material (per-technique methodology, query templates) that belongs in separate files is all inlined, and no bundle files are present.	2 / 5
	Total	11 / 20 Passed

Description

67%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and has an explicit 'Use when' trigger, covering a distinctive niche (0day discovery / N-day weaponization). It is weakened by mixed-language jargon and a non-natural trigger phrase ('猎人思维') that a user would not naturally say.

Suggestions

Replace jargon like '猎人思维' and label-only technique names with natural user-facing trigger phrases such as 'find a 0day', 'no public CVE exists', or 'build an exploit from an advisory'.

State the trigger in plain language users would actually say, e.g. 'Use when no public vulnerability or PoC exists and you need to find a new 0day or weaponize an N-day advisory'.

Add common synonyms / file-type-free cues ('exploit development', 'patch diffing', 'variant analysis') to broaden natural keyword coverage.

Dimension	Reasoning	Score
Specificity	Names the domain plus multiple concrete actions (变体分析/补丁间隙/差分/Fuzzing/污点推理/N-day武器化), each a distinct technique rather than vague abstractions, though they are listed as labels without elaboration.	4 / 5
Completeness	It answers both 'what' (autonomous 0day discovery engine via named techniques) and 'when' with an explicit 'Use when public vulns not found and need to discover 0day or weaponize N-day', though the trigger could be more specific.	4 / 5
Trigger Term Quality	It contains relevant terms ('0day', 'N-day', 'weaponize', 'Fuzzing', 'public vulns not found'), but the natural phrases a user would say ('find a 0day', 'when no CVE exists', 'exploit dev') are mixed with Chinese jargon and '猎人思维' which a user would not naturally utter, leaving common variations missing.	3 / 5
Distinctiveness Conflict Risk	The niche (autonomous 0day discovery / N-day weaponization when public CVEs are absent) is distinctive and unlikely to trigger for routine pentest or CVE-lookup skills, with only minor overlap risk with general exploit-dev skills.	4 / 5
	Total	15 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
metadata_field	'metadata' should map string keys to string values	Warning

	Total	14 / 16 Passed

Repository: Ed1s0nZ/CyberStrikeAI
Path: skills/zero-day-discovery/SKILL.md
Commit: 893f134

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.