vulnresearch-orchestrator

Five-stage modular vulnerability pipeline orchestrator. Delegates scan → detect → verify → patch → exploit through OPPLAN objectives. Load at orchestrator startup.

Quality

74%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/plugins/vulnresearch/SKILL.md

Quality

Content

82%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is lean, well-structured, and highly actionable with concrete delegation templates and explicit stage preconditions plus validation hooks (kg_stats, patch_verify). The main gaps are the absence of an error-recovery feedback loop and content that is entirely inline where a single reference file could ease the load.

Suggestions

Add an explicit failure/recovery branch: what to do when a stage's validation (kg_stats delta or patch_verify) fails before re-launching the next stage.

Consider moving the per-stage delegation examples and OPPLAN template into a reference file (e.g. references/opplan.md) referenced one level deep from the body.

Resolve the parameterized placeholders ('appropriate shard_total', 'top 20 unprocessed candidates') into concrete defaults or a brief selection rule.

Dimension	Reasoning	Score
Conciseness	Lean and efficient throughout — no padding explaining what vulnerabilities or scanning are; terse opinionated lines like 'fresh context per batch is the whole point of the pipeline' assume Claude's competence and every section earns its place.	5 / 5
Actionability	Provides copy-paste-ready delegation prompts covering all five stages with concrete values (shard_total=8, top 50, top 20), but parameterized placeholders like 'appropriate shard_total' and 'top 20 unprocessed candidates' leave minor gaps.	4 / 5
Workflow Clarity	Clear five-stage sequence with explicit preconditions ('Launch a stage ONLY when its preconditions are met') and validation checkpoints (kg_stats deltas, patch_verify), but no explicit error-recovery feedback loop when a stage fails validation.	4 / 5
Progressive Disclosure	Well-organized into clearly labeled sections (stage dependencies, OPPLAN template, batch sizes, delegation examples, report format) with no nested references, but at ~80 lines the OPPLAN and delegation examples could be split into a one-level-deep reference file.	4 / 5
	Total	17 / 20 Passed

Description

66%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description clearly states what the skill does and enumerates concrete stages, but it lacks an explicit 'Use when...' trigger clause — the only 'when' guidance is a load-time lifecycle instruction, which caps completeness. Trigger terms are solid but slightly jargon-heavy.

Suggestions

Add an explicit trigger clause, e.g. 'Use when coordinating a multi-stage vulnerability research engagement across scan, detect, verify, patch, and exploit stages.'

Replace 'Load at orchestrator startup' with user-need-oriented 'when' guidance so the description answers when a user would invoke this skill.

Soften jargon ('OPPLAN objectives') or pair it with a natural synonym ('delegation objectives') to broaden trigger coverage.

Dimension	Reasoning	Score
Specificity	Names the domain and lists several concrete actions via the explicit 'scan → detect → verify → patch → exploit' stage chain, but the 'actions' are stage-level delegations rather than granular operations, leaving minor coverage gaps.	4 / 5
Completeness	Has a clear 'what' (five-stage pipeline orchestrator that delegates), but the only 'when' is the lifecycle instruction 'Load at orchestrator startup' — there is no 'Use when...' trigger clause, so completeness is capped at 3 per the missing-trigger guidance.	3 / 5
Trigger Term Quality	Includes natural domain terms a vulnresearch user would say ('vulnerability', 'scan', 'patch', 'exploit') with good coverage, though jargon like 'OPPLAN objectives' and missing synonyms ('vulnerability research', 'pentest') leave a few natural terms out.	4 / 5
Distinctiveness Conflict Risk	The orchestrator framing and OPPLAN/stage vocabulary carve a clear niche, but the individual stage names (scan, patch) create minor overlap risk with sibling single-stage skills.	4 / 5
	Total	15 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/plugins/vulnresearch/SKILL.md
Commit: 0cf691e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.