Content
71%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A lean, genuinely actionable audit playbook: concrete grep/slither commands, modifier bug-pattern tables, executable Foundry PoCs, and severity calibration outweigh its flaws. The main gaps are a dangling cross-skill reference, PoC confirmation not explicitly tied into the workflow as a validation step, and exemplar/template bulk that would be better split into reference files.
Suggestions
Make PoC confirmation an explicit workflow step (e.g. step 8: "For each candidate, write and run a PoC from the template below before reporting") to close the validation loop.
Remove or fix the dangling "sig-replay/SKILL.md" reference, and move the known-exemplars list and PoC templates into references/ files (e.g. references/exemplars.md, references/poc-templates.md) to slim the main SKILL.md.
Drop the off-scope exemplars (Wormhole signature bug, Multichain key compromise) that the skill itself flags as not strictly access-control, and verify the slither-check-erc usage for selector-collision detection.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is dense — tables of modifier patterns, grep commands, and Foundry PoCs with almost no explanation of concepts Claude already knows. Not 5: the "most boring class — and the most common" commentary and the two exemplars flagged as "not strictly access-control" (Wormhole, Multichain) are tokens that don't earn their place. | 4 / 5 |
Actionability | Highly concrete throughout: copy-paste greps (`grep -rn 'tx.origin' src/`), slither commands, full Foundry test templates, and a remediation contract. Not 5: `slither-check-erc src/Impl.sol --erc ERC1967` for selector collisions is dubious tool usage, and the BRE alternation in `grep -v 'internal\|private\|public\|external'` is fragile across grep variants. | 4 / 5 |
Workflow Clarity | A clearly sequenced 7-step audit process (find state-changers → interrogate each → audit modifiers → grep anti-patterns → initializer/proxy checks → role hierarchy) with a severity-calibration decision table. Not 5: the PoC template section is presented as reference material rather than wired in as an explicit "confirm each candidate with a PoC before reporting" checkpoint, so the validation loop is implicit. | 4 / 5 |
Progressive Disclosure | No bundle files exist (no references/, scripts/, or assets/), yet the body cites "adjacent (sig-replay/SKILL.md)" — a dangling pointer to a nonexistent file. At ~195 lines, the known-exemplar list and four PoC templates are content that could live in references/ files; sections are well-organized but inlined bulk keeps this at the 'could be better organized' anchor rather than 4. | 3 / 5 |
Total | 15 / 20 Passed |