CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

oracle-manipulation

Hunt single-block oracle manipulation — spot-price AMM oracles, manipulable TWAP, dependent calculations, missing staleness checks.

Quality

76%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/contracts/oracle-manipulation/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

75%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A lean, highly actionable audit playbook with concrete grep commands, executable Solidity patterns, a severity table, and real-world exemplars. The main gaps are the pseudocode flash-loan PoC and the lack of an explicit error-recovery loop in the audit workflow.

Suggestions

Make the flash-loan PoC executable (or explicitly justify the pseudocode, e.g. 'adapt pool/token addresses to the target') so the Foundry section is copy-paste ready like the rest of the code.

Add a short feedback step to the audit workflow, e.g. 'If the PoC shows no profit, re-check liquidity depth and slippage before downgrading severity.'

Move the known-exemplars list and severity-calibration table into a reference file (e.g. references/exemplars.md) to keep SKILL.md a tighter overview.

DimensionReasoningScore

Conciseness

The body is dense and lean — grep one-liners, compact vulnerable/good Solidity pairs, a severity table, and one-line exemplars — with no re-explanation of concepts Claude already knows. Minor trimming is possible (the comment-heavy pseudocode PoC and dated exemplar list), keeping it just below the every-token-earns-its-place anchor 5.

4 / 5

Actionability

Copy-paste-ready grep commands, executable Solidity for the vulnerable/secure latestRoundData patterns and remediation, and a concrete vm.mockCall staleness test. The flash-loan PoC is explicitly pseudocode ('// Pseudo:') with comment-steps rather than executable code — the main gap preventing a 5.

4 / 5

Workflow Clarity

The 'Audit steps' section gives a clear 1→4 sequence, and step 2 functions as a per-vector checklist (spot price? TWAP window? updatedAt/answeredInRound?) with the stale-price test providing explicit verification ('If we reach here w/o revert → bug'). Missing an explicit error-recovery loop (what to re-check when a PoC disproves the hypothesis) keeps it below 5.

4 / 5

Progressive Disclosure

A single-file skill (~145 lines) with no bundle files and well-organized, clearly headed sections. It exceeds the 50-line simple-skill threshold, and the severity-calibration table and known-exemplars list are natural candidates for a separate reference file — matching the good-structure-with-minor-organization-gaps anchor 4.

4 / 5

Total

16

/

20

Passed

Description

70%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A specific, well-targeted description with strong niche vocabulary, but it answers only 'what', not 'when' — an explicit 'Use when...' clause is missing from the description field. Adding trigger phrases would raise both completeness and trigger-term coverage.

Suggestions

Append a 'Use when...' clause to the description, e.g. 'Use when auditing DeFi protocols that read on-chain prices, or when the user mentions oracle manipulation, TWAP, or price feeds.'

Add missing natural synonyms such as 'price feed', 'Chainlink', and 'flash loan' to broaden trigger-term coverage.

Mention the L2 sequencer-downtime and custom-oracle vectors in the description so the listed surfaces match the body's coverage.

DimensionReasoningScore

Specificity

The description lists several concrete vulnerability classes — 'spot-price AMM oracles, manipulable TWAP, dependent calculations, missing staleness checks' — matching the several-specific-actions anchor. It falls short of 5 because vectors covered in the body (L2 sequencer downtime, custom oracles reading manipulable storage) are absent from the description.

4 / 5

Completeness

The 'what' is clear ('Hunt single-block oracle manipulation' plus a vector list), but the description field contains no 'Use when...' clause or equivalent explicit trigger guidance, capping completeness at 3 per the rubric guideline. Not 2 because the 'what' is specific and the frontmatter's separate when_to_use metadata weakly implies the 'when'.

3 / 5

Trigger Term Quality

Includes natural terms users would say when they need this skill: 'oracle manipulation', 'TWAP', 'spot-price', 'staleness'. A few common synonyms are missing ('price feed', 'Chainlink', 'flash loan'), keeping it below the comprehensive-coverage anchor 5.

4 / 5

Distinctiveness Conflict Risk

A clear niche (single-block oracle manipulation in smart-contract security auditing) with distinct trigger terms ('oracle', 'TWAP', 'spot-price', 'staleness') and minimal overlap with adjacent skills — matching the clear-niche anchor 5.

5 / 5

Total

16

/

20

Passed

Validation

87%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

metadata_field

'metadata' should map string keys to string values

Warning

Total

14

/

16

Passed

Repository

PurpleAILAB/Decepticon

Path

packages/decepticon/decepticon/skills/standard/contracts/oracle-manipulation/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.