Content
81%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The skill body is a tight, actionable white-box hunting playbook with a clearly sequenced loop and an explicit prove-or-discard validation gate that appropriately caps false-positive risk. It stays lean and well-structured with only minor verbosity and no bundle-file overhead.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is largely lean and assumes Claude's competence (e.g. lists sinks and sources without explaining what they are), with only minor padding such as the bounty-payout ranking rationale in 'High-Value Vulnerability Classes'. | 4 / 5 |
Actionability | It provides concrete executable commands (find, semgrep, grep) and a complete validate_finding checklist with required fields, though the kg_add_node/validate_finding calls are assumed-available tools rather than fully self-contained runnable snippets. | 4 / 5 |
Workflow Clarity | The core loop is explicitly sequenced as Steps 1-5 with a hard validation checkpoint in Step 5 ('If you cannot reproduce it, it is NOT a finding'), plus a 'What NOT to Do' guardrail list — a clear feedback loop for a destructive/batch-style submission workflow. | 5 / 5 |
Progressive Disclosure | Content is well-organized into focused sections (Target Assessment, Methodology, Vuln Classes, Report Convention, What NOT to Do) with no nested references; no bundle files exist, which is appropriate for this length, though some sections (vuln-class detail, report examples) could be split into references if it grew. | 4 / 5 |
Total | 17 / 20 Passed |