code-understanding

Provides adversarial code comprehension for security research, mapping architecture, tracing data flows, and hunting vulnerability variants to build ground-truth understanding before or alongside static analysis.

Quality

65%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

High

Do not use without reviewing

Fix and improve this skill with Tessl

tessl review fix ./.claude/skills/code-understanding/SKILL.md

Quality

Content

71%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a tight, well-structured instruction set for a security-research comprehension skill with clear modes, gates, and output contracts. Its main weakness is reliance on referenced stage files and libexec scripts that are absent from the bundle, weakening progressive disclosure and full actionability.

Suggestions

Either include the referenced stage files (e.g. map.md) in the bundle or inline the per-stage instructions so the skill is self-contained.

Add a brief 'Prerequisites / bundle layout' note listing the libexec/ scripts and stage files the instructions depend on, so missing components are obvious.

Trim the checklist schema table and validation-pipeline prose, moving them to a reference file if they are not needed at first invocation.

Dimension	Reasoning	Score
Conciseness	The body is well-organized and assumes Claude's competence (modes table, gates, concise execution rules) with minimal over-explanation of concepts Claude already knows; a few sections like the checklist schema table and integration prose add length that could be tightened slightly.	4 / 5
Actionability	Execution rules are concrete and prescriptive ('Quote the exact line (file path + line number)', 'search the full codebase'), and output formats are specified, but the guidance references stage files (map.md) and libexec scripts that are not in the bundle, so some steps cannot be fully executed from this file alone.	4 / 5
Workflow Clarity	Modes, stages, and gates are clearly sequenced with an explicit progression ('Map → Study → Trace → Hunt') and the GATE-U rules act as validation checkpoints (READ-FIRST, EVIDENCE-ONLY), though the per-stage validation feedback loops live in referenced stage files rather than being fully inline.	4 / 5
Progressive Disclosure	Structure is reasonable with section headers and one-level references to stage-specific files (map.md, 'stage-specific files'), but those referenced files are not present in the bundle, so navigation is signaled toward targets that cannot be verified, and the detailed stage content is delegated rather than split into visible files.	3 / 5
	Total	15 / 20 Passed

Description

60%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and third-person, naming concrete adversarial-analysis actions with a clear security-research niche. It is capped by a missing explicit 'Use when...' trigger clause, leaving the 'when' only weakly implied.

Suggestions

Add an explicit trigger clause, e.g. 'Use when investigating unfamiliar code for security flaws, tracing data flows from untrusted input to sinks, or hunting variants of a known vulnerability.'

Enumerate the core modes (map, trace, hunt, study, teach) so the breadth of capabilities is explicit rather than summarized.

Include a few concrete synonyms users naturally say — 'source-to-sink flow', 'finding variants', 'attack surface' — to broaden trigger coverage.

Dimension	Reasoning	Score
Specificity	Lists several concrete actions — 'mapping architecture, tracing data flows, and hunting vulnerability variants' — plus the purpose 'build ground-truth understanding', but coverage of the five distinct modes (map/trace/hunt/study/teach) is summarized rather than enumerated, leaving minor gaps.	4 / 5
Completeness	The 'what' is clearly stated, but there is no explicit 'Use when...' trigger clause answering when Claude should invoke it; the 'when' is only weakly implied via 'before or alongside static analysis', which per the rubric caps completeness at 3.	3 / 5
Trigger Term Quality	Natural terms like 'security research', 'data flows', 'vulnerability variants', and 'static analysis' are present and likely to be said by users, but common synonyms and concrete file/extension triggers are not exhaustively covered.	4 / 5
Distinctiveness Conflict Risk	The security-research framing and adversarial-comprehension niche are fairly distinct from general code skills, with only minor overlap risk against generic static-analysis or code-review skills.	4 / 5
	Total	15 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: gadievron/raptor
Path: .claude/skills/code-understanding/SKILL.md
Commit: 4e75ac9

Reviewed: 4 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.