gitnexus-taint-analysis

Use when working on, reviewing, or extending GitNexus's CFG/taint/PDG subsystem (the `--pdg` layers), or when reasoning about source→sink data-flow findings. Examples: "How does taint analysis work here?", "Why didn't explain find this flow?", "Add a new sink/source", "Review the interprocedural taint code".

Quality

90%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

92%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A high-quality, expertly written skill body: lean, actionable, with a strong validation-gated workflow. The only weakness is progressive disclosure — everything lives in one long file with no external references to split out the deeper reference material.

Suggestions

Move the interprocedural summary-edge table and the 'Prior art' section into a separate reference file (e.g. references/interproc-design.md) and link to it from the body to reduce inline bulk.

Extract the model-editing details (the four-language file map and fixture/harness locations) into a references/adding-models.md pointer so the main body stays a concise overview.

Consider a references/ directory with a one-page glossary of the bit/issue identifiers (e.g. M3 #2083, KTD1, S1, U9) referenced throughout, so readers can resolve them without context loss.

Dimension	Reasoning	Score
Conciseness	Dense expert knowledge that assumes competence (no basic-concept padding) and earns every token; the length reflects inherent subsystem complexity rather than verbosity, with terse cross-references like "M3 #2083" and "bit M4 U9".	5 / 5
Actionability	Provides concrete file paths (`taint/summary-model.ts`, `taint/path-codec.ts`), executable commands (`node scripts/build.js`, `bench/cfg/measure.mjs --check`), and named seams (`registerBuiltinTaintModels`) that are copy-paste ready and cover the common change cases.	5 / 5
Workflow Clarity	The "Validation checklist" is a clearly sequenced 5-step workflow with explicit validation checkpoints (flag-off golden byte-identical, fingerprint-drift check, detect_changes/impact before editing shared symbols) and a build-order sequence (L1–L4) with feedback-loop guidance.	5 / 5
Progressive Disclosure	Well-organized section headers, but ~180 lines are inlined as a monolithic SKILL.md with no external bundle references; content like the summary-edge table and the prior-art section could be split into separate reference files for easier navigation.	3 / 5
	Total	18 / 20 Passed

Description

87%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, well-targeted description: it names the domain, gives an explicit "Use when..." trigger, and lists concrete example phrases a user would naturally say. Minor room to sharpen the top-level verbs beyond "working on / extending".

Dimension	Reasoning	Score
Specificity	Names the domain (CFG/taint/PDG `--pdg` subsystem) and several concrete actions ("working on, reviewing, or extending", "reasoning about source→sink data-flow findings") plus example tasks, but the top-level actions remain somewhat abstract rather than discrete operations.	4 / 5
Completeness	Explicitly answers both what (working on / extending / reasoning about the CFG/taint/PDG subsystem) and when (an explicit "Use when..." clause with concrete example trigger phrases).	5 / 5
Trigger Term Quality	Includes natural example phrases users would say ("How does taint analysis work here?", "Add a new sink/source", "Review the interprocedural taint code") with good keyword coverage, though synonyms and file extensions are absent.	4 / 5
Distinctiveness Conflict Risk	Scoped to a single named subsystem (GitNexus's CFG/taint/PDG `--pdg` layers) with distinct triggers, giving it a clear niche and minimal conflict risk.	5 / 5
	Total	18 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
referenced_paths_exist	Referenced path issues: 1 missing	Warning

	Total	15 / 16 Passed

Repository: abhigyanpatwari/GitNexus
Path: .claude/skills/gitnexus/gitnexus-taint-analysis/SKILL.md
Commit: c6b2416

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.