CtrlK
BlogDocsLog inGet started
Tessl Logo

redos

Hunt ReDoS (CWE-1333, Catastrophic Backtracking) — identify regexes with nested quantifiers or overlapping alternation that cause super-linear matching time, trace tainted input paths to regex sinks, demonstrate timing PoC, and validate with response-time delta. Covers PCRE/RE2/V8/Python re engine differences. Triggers on: 'ReDoS', 'regex denial', 'catastrophic backtracking', 'redos', 'regex complexity', 'nested quantifiers', 'regex amplification', 'CWE-1333'.

73

Quality

91%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

SKILL.md
Quality
Evals
Security

Quality

Content

82%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, highly actionable ReDoS playbook with executable commands, a timing PoC, and explicit validation contracts. It is concise and self-contained with clear section navigation, with only minor room to tighten reference-style tables and formalize validation feedback loops.

Suggestions

Add an explicit 'validate -> fix -> re-validate' loop after the validate_finding contract so failed timing deltas route back to evil-string scaling before promotion.

Consider moving the engine backtracking table and CVSS table into a references file to keep SKILL.md leaner, since Claude already knows most engine behaviors.

Tighten Section 7 engine notes by collapsing shared 'no backtrack limit by default' phrasing across Python/Java/V8 into a single line plus per-engine specifics.

DimensionReasoningScore

Conciseness

Mostly lean with executable grep and Python snippets earning their place, though the engine table and CVSS table add length that is useful but borders on reference material Claude partly already knows.

4 / 5

Actionability

Copy-paste-ready grep recipes per language, an executable evil-string timing PoC, and concrete validate_finding contracts cover the common cases directly.

5 / 5

Workflow Clarity

A clear 9-step sequence runs from engine identification through validation, with an explicit timing PoC and a validate_finding contract; it lacks a formal stop-and-revalidate feedback loop after a failed validation, so it sits just below a 5.

4 / 5

Progressive Disclosure

No bundle files exist and the body is a single well-sectioned overview, which is appropriate for a self-contained playbook; minor inline reference material (engine/CVSS tables) could conceivably be split out but the structure is clear.

4 / 5

Total

17

/

20

Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that clearly states what the skill does and when to trigger it, with comprehensive natural keyword coverage. Third-person voice is used throughout.

DimensionReasoningScore

Specificity

Lists multiple concrete actions — 'identify regexes with nested quantifiers or overlapping alternation', 'trace tainted input paths to regex sinks', 'demonstrate timing PoC', and 'validate with response-time delta' — covering the hunt end-to-end.

5 / 5

Completeness

Explicitly answers both 'what' (identify, trace, demonstrate, validate) and 'when' via the 'Triggers on:' clause listing concrete trigger phrases.

5 / 5

Trigger Term Quality

Comprehensive natural-term coverage including the acronym 'ReDoS', 'regex denial', 'catastrophic backtracking', 'regex complexity', 'nested quantifiers', 'regex amplification', and the standard 'CWE-1333' — terms a user would actually say.

5 / 5

Distinctiveness Conflict Risk

A narrow ReDoS/CWE-1333 niche with engine-specific scoping (PCRE/RE2/V8/Python) and distinctive triggers; minimal overlap with adjacent skills.

5 / 5

Total

20

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

Total

15

/

16

Passed

Repository
PurpleAILAB/Decepticon
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.