CtrlK
BlogDocsLog inGet started
Tessl Logo

access-control

Missing modifiers, wrong msg.sender checks, default-public functions, missing onlyOwner / onlyRole / onlyDAO authorization.

62

Quality

74%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/contracts/access-control/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

82%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a dense, highly actionable audit playbook with executable grep/slither/Foundry/OZ code and a clear sequenced workflow. It is concise and well-structured; the main gap is the absence of explicit validation checkpoints inside the numbered audit flow and some inlined reference material that could live in a separate file.

DimensionReasoningScore

Conciseness

Mostly efficient and dense — assumes Solidity knowledge, uses tables and tight code blocks throughout — with minor reference-heavy sections (Known exemplars list, separate severity + CVSS tables) that could be trimmed slightly.

4 / 5

Actionability

Fully executable guidance throughout: copy-paste grep and slither commands, runnable Foundry PoC tests using real cheatcodes (vm.prank, vm.expectRevert), and concrete OpenZeppelin remediation code covering the common cases.

5 / 5

Workflow Clarity

Audit steps are clearly sequenced 1-7 (find state-changers, audit modifiers, grep anti-patterns, initializers, selector collisions, roles) with the PoC template acting as verification, but explicit validation checkpoints are not woven into the step sequence as marked steps.

4 / 5

Progressive Disclosure

Well-organized into clear sections with headers and no nested references (no bundle files exist; the only cross-link is a sibling-skill pointer 'sig-replay/SKILL.md'); reference material like exemplars and severity tables is inlined rather than split, a minor organization gap for a >50-line file.

4 / 5

Total

17

/

20

Passed

Description

66%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is concrete and highly specific to smart-contract access control, but it reads as a bug-list rather than a capability statement and omits an explicit 'Use when' trigger clause from the description field itself. Adding a verb-framed action and an inline use-when clause would raise completeness and specificity.

Suggestions

Reframe the description with an action verb, e.g. 'Audits smart-contract access control for missing modifiers, wrong msg.sender checks, default-public functions, and missing onlyOwner/onlyRole/onlyDAO authorization.'

Add an explicit 'Use when...' clause to the description field (e.g. 'Use when auditing Solidity contracts for access-control flaws or when the user mentions onlyOwner, missing modifiers, or privilege escalation.') so completeness is not capped at 3.

Include the natural phrase 'access control' and synonyms like 'permission' or 'privilege escalation' to broaden trigger-term coverage.

DimensionReasoningScore

Specificity

Lists several concrete bug categories ('Missing modifiers', 'wrong msg.sender checks', 'default-public functions', 'missing onlyOwner / onlyRole / onlyDAO authorization') rather than vague language, though they are noun-phrase targets rather than verb-framed actions.

4 / 5

Completeness

Has a clear 'what' (specific bug categories to find) but no explicit 'when/Use when' clause in the description field itself — the trigger guidance lives only in metadata.when_to_use, so completeness is capped at 3 per the missing-trigger-clause rule.

3 / 5

Trigger Term Quality

Good coverage of niche-specific technical keywords (onlyOwner, onlyRole, onlyDAO, msg.sender, modifier, authorization) that an auditor would naturally say, but missing broader natural synonyms like 'access control' or 'permission'.

4 / 5

Distinctiveness Conflict Risk

The Solidity-specific terms (onlyOwner, onlyRole, onlyDAO, msg.sender) carve a clear niche with minimal conflict against non-smart-contract skills, though minor overlap risk exists with adjacent smart-contract audit skills in the same family.

4 / 5

Total

15

/

20

Passed

Validation

87%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation14 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

metadata_field

'metadata' should map string keys to string values

Warning

Total

14

/

16

Passed

Repository
PurpleAILAB/Decepticon
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.