CtrlK
BlogDocsLog inGet started
Tessl Logo

kunlun-m-general

当你要用 Kunlun-M(静态白盒漏洞扫描)扫描 PHP/JS/Solidity/Chrome Ext 源码,或需要通过命令 scan/generate 快速落地 source/sink(tamper/rule)并回归验证时使用。触发命令:kunlun.py scan / kunlun.py generate rule / kunlun.py generate tamper。

72

Quality

91%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

SKILL.md
Quality
Evals
Security

Quality

Content

90%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is lean, highly actionable, and well-sequenced with a smoke-test validation step, reflecting strong script-driven skill design. Its main gaps are missing intra-workflow validation checkpoints in the destructive bootstrap path and some broken/out-of-bundle reference paths.

Suggestions

Add explicit validate-before-proceeding checkpoints to the bootstrap workflow (e.g., confirm pip install and DB init succeeded before load rules/tamper) to satisfy the feedback-loop expectation for destructive/batch operations.

Fix reference links to use relative paths (e.g., references/concepts.md) instead of absolute file:///d:/program/Kunlun_M/... URLs, which are broken and non-portable.

Resolve or remove out-of-bundle references (platforms/README.md, tools/ci_scan.py) — either add them to the bundle or note clearly that they live in the host repo, so progressive-disclosure navigation is unambiguous.

DimensionReasoningScore

Conciseness

The body is lean and explicitly script-driven ('本 skill 只包含可直接执行的脚本与最小流程,优先用脚本完成动作,不在 SKILL.md 里展开原理解释'), assuming Claude's competence and keeping every section to actionable minimums without padding.

5 / 5

Actionability

Every section provides copy-paste-ready, fully executable bash commands with concrete flags covering scan, gen-rule, gen-tamper, sync, smoke-test, and report rendering, matching the fully-executable anchor.

5 / 5

Workflow Clarity

Processes are clearly sequenced (prep → daily actions → smoke test → report) and the dedicated smoke-test section provides a validation checkpoint, but destructive/batch steps within bootstrap (clone → pip install → DB init → load rules) lack explicit validate-before-proceeding feedback loops, capping it just below the top anchor.

4 / 5

Progressive Disclosure

Structure is good with a lean overview pointing one level deep to real bundle files (references/concepts.md, references/report_template.md, scripts/*.py), but reference links use broken Windows absolute file:/// paths and point to files outside the bundle (platforms/README.md, tools/ci_scan.py), leaving minor navigation gaps.

4 / 5

Total

18

/

20

Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, complete, and distinct, clearly stating both what the skill does and when to use it with concrete trigger commands. Its only weakness is trigger-term breadth, relying on command names and technical jargon rather than a fuller set of natural synonyms.

DimensionReasoningScore

Specificity

The description lists multiple concrete actions — '扫描 PHP/JS/Solidity/Chrome Ext 源码', 'generate rule', 'generate tamper', '快速落地 source/sink', and '回归验证' — giving comprehensive coverage of the skill's capabilities rather than vague language.

5 / 5

Completeness

It explicitly answers both 'what' (scan PHP/JS/Solidity/Chrome Ext source, generate rule/tamper to land source/sink and regression-verify) and 'when' via the explicit '当你要用…时使用' trigger clause plus '触发命令:…', matching the both-what-and-when-with-concrete-trigger-phrases anchor.

5 / 5

Trigger Term Quality

It surfaces natural keywords for the target audience ('静态白盒漏洞扫描', '源码', 'scan', 'generate rule/tamper') and the explicit trigger commands, but lacks common synonyms and file extensions, so it falls short of the comprehensive-coverage anchor.

4 / 5

Distinctiveness Conflict Risk

The description targets a clear niche — Kunlun-M static white-box vulnerability scanning with specific scan/generate commands — making it highly distinct with minimal conflict risk against unrelated skills.

5 / 5

Total

19

/

20

Passed

Validation

87%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation14 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

relative_links

Relative link issues: 3 suspicious

Warning

Total

14

/

16

Passed

Repository
LoRexxar/Kunlun-M
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.