CtrlK
BlogDocsLog inGet started
Tessl Logo

upgradeable-proxy

Proxy upgrade patterns and their bugs — uninitialized implementation, storage slot collisions, selector clashes, unprotected upgrade auth.

62

Quality

74%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/contracts/upgradeable-proxy/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

78%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with concrete code, commands, and templates organized into a clear audit checklist. It is concise and well-sequenced, though everything is inlined into one file with no progressive-disclosure references.

Suggestions

Extract the 'Known exemplars', 'CVSS', and 'PoC template' sections into reference files (e.g. references/exemplars.md, references/poc-template.md) linked from the overview to improve progressive disclosure.

Add an explicit validate→fix→re-validate loop note for the upgrade-safety CI step (run slither-check-upgradeability, fix collisions, re-run) to strengthen workflow checkpoints.

DimensionReasoningScore

Conciseness

Largely lean — checklist items pair vulnerable/safe Solidity snippets with one-line attack notes and grep commands; only minor introductory framing could be trimmed.

4 / 5

Actionability

Fully executable throughout: copy-paste Solidity vulnerable/safe pairs, grep and slither commands, a Foundry PoC template, and remediation templates covering the common cases.

5 / 5

Workflow Clarity

A numbered 8-item audit checklist gives a clear sequence with verification signals (slither-check-upgradeability, CI gate); minor validation gaps keep it just below a fully checkpointed workflow.

4 / 5

Progressive Disclosure

Well-sectioned single file, but no bundle files exist and content that could live in references (exemplars, CVSS, PoC template) is inlined, leaving structure adequate but not split.

3 / 5

Total

16

/

20

Passed

Description

70%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and distinct, naming concrete proxy bug classes a specialist would recognize. Its main weakness is the absence of an explicit 'Use when...' trigger clause, which caps completeness.

Suggestions

Add an explicit 'Use when...' clause, e.g. 'Use when auditing upgradeable proxies (UUPS, Transparent, EIP-1967) for uninitialized implementations, storage collisions, or unprotected upgrade auth.'

Include a few more natural trigger synonyms users might say (e.g. 'proxy upgrade', 'EIP-2535 diamond', 'delegatecall storage clash') to broaden trigger coverage.

DimensionReasoningScore

Specificity

Names the domain (proxy upgrade patterns) and enumerates four concrete bug classes — 'uninitialized implementation, storage slot collisions, selector clashes, unprotected upgrade auth' — giving specific coverage with only minor gaps.

4 / 5

Completeness

Clearly states what the skill covers, but lacks an explicit 'Use when...' trigger clause; per the guidelines a missing explicit trigger caps completeness at 3.

3 / 5

Trigger Term Quality

Includes natural specialist terms ('upgradeable proxy', 'UUPS', 'EIP-1967', 'storage collision') that an auditor would actually say; good coverage though a few common synonyms are absent.

4 / 5

Distinctiveness Conflict Risk

Occupies a clear niche (upgradeable-proxy bugs in smart contracts) with distinct, specific triggers and minimal overlap risk with other skills.

5 / 5

Total

16

/

20

Passed

Validation

87%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation14 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

metadata_field

'metadata' should map string keys to string values

Warning

Total

14

/

16

Passed

Repository
PurpleAILAB/Decepticon
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.