CtrlK
BlogDocsLog inGet started
Tessl Logo

pattern-exhaustion

Systematic pattern exhaustion methodology. Load after finding any confirmed vulnerability to search for all instances of the same root cause pattern across the codebase.

69

Quality

85%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

88%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with executable commands and a well-sequenced, validated workflow including explicit stop criteria. It is only slightly held back by light motivational padding and a large inline pattern table that could be externalized.

Suggestions

Trim the motivational opening paragraph and the real-world CVE examples, or move them to a brief 'Background' note, to tighten conciseness toward the lean anchor.

Consider extracting the 10-row root-cause grep table into a references file (e.g. patterns.md) referenced from the body, improving progressive disclosure and keeping SKILL.md as an overview.

Add an explicit fix-and-retry feedback loop in step 4 for cases where validation returns validated=false but the candidate still looks promising, to strengthen the error-recovery dimension of workflow clarity.

DimensionReasoningScore

Conciseness

The body is mostly efficient with concrete grep/semgrep commands and KG snippets, but the motivational opening ('The same developer who wrote one broken auth check likely wrote twenty') and the illustrative real-world CVE list are minor padding that could be trimmed, fitting the 'efficient, minor over-explanation' anchor rather than the fully-lean anchor at 5.

4 / 5

Actionability

Provides fully executable grep commands across 10 root-cause patterns, a runnable semgrep invocation, and concrete kg_add_node/kg_add_edge snippets with realistic props, matching the 'fully executable, copy-paste ready, covers common cases' anchor.

5 / 5

Workflow Clarity

A clear 5-step Exhaustion Loop (Classify → Enumerate → Prioritize → Verify → Exhaustion criteria) with an explicit validation gate in step 4 ('only a result with validated=true becomes a separate operational finding'), a 4-point enumerate checklist, and explicit stop criteria, satisfying the validation requirement for batch operations and matching the top anchor.

5 / 5

Progressive Disclosure

Well-organized into clear sections with no nested references and no bundle files to mismanage, but the skill exceeds 50 lines and the large 10-row grep pattern table could plausibly live in a separate reference file, representing the minor organization gap of the 'good structure' anchor rather than the ideally-split anchor at 5.

4 / 5

Total

18

/

20

Passed

Description

82%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description clearly states both capability and an explicit load trigger, with a distinct security niche. It is slightly light on enumerating multiple concrete actions and on synonym coverage, which keeps specificity and trigger_term_quality off the top.

DimensionReasoningScore

Specificity

Names the domain ('pattern exhaustion methodology') and one concrete action ('search for all instances of the same root cause pattern across the codebase'), but does not enumerate several distinct actions, matching the '1-2 concrete actions, not comprehensive' anchor rather than the multi-action anchor at 4.

3 / 5

Completeness

Explicitly answers both what ('search for all instances of the same root cause pattern across the codebase') and when with a concrete trigger phrase ('Load after finding any confirmed vulnerability'), satisfying the explicit-trigger requirement and matching the top anchor rather than the 4 anchor whose 'when' is less specific.

5 / 5

Trigger Term Quality

Includes natural terms a user would say ('vulnerability', 'root cause pattern', 'codebase', 'instances') with good coverage, though it omits common synonyms like 'bug', 'flaw', or 'variant', fitting the 'good keyword coverage, a few natural terms missing' anchor.

4 / 5

Distinctiveness Conflict Risk

Occupies a clear niche (post-confirmation variant hunting across a codebase) with a distinct trigger ('after finding any confirmed vulnerability'), giving minimal overlap risk with general vulnerability-discovery skills.

5 / 5

Total

17

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

Total

15

/

16

Passed

Repository
PurpleAILAB/Decepticon
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.