code-understanding

Provides adversarial code comprehension for security research, mapping architecture, tracing data flows, and hunting vulnerability variants to build ground-truth understanding before or alongside static analysis.

Quality

61%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./.claude/skills/code-understanding/SKILL.md

Quality

Content

62%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is well structured with clear modes, gates, and staged workflow, but loses points for overlapping tables, execution detail deferred to absent bundle files, and broken references.

Suggestions

Either ship the referenced stage files (map.md and the stage-specific instructions) or inline the essential per-stage steps so the skill is actionable without missing files.

Dedupe the Modes and Stages tables — they repeat the Map/Trace/Hunt/Teach mapping — and trim the Purpose section that restates the description.

Surface the actual libexec script invocations concretely in the body rather than only referencing them as "shown in the prompts".

Dimension	Reasoning	Score
Conciseness	Mostly efficient with purposeful tables and gates, but the Modes and Stages tables overlap and the Purpose section restates the description; not score 3 because of this redundancy, not score 1 because it avoids explaining concepts Claude already knows.	2 / 3
Actionability	Provides concrete flags, output formats, confidence definitions, and a checklist schema, but defers actual execution to "libexec/raptor-*" scripts and "stage-specific files" that are not present in the bundle; not score 3 because guidance is not fully executable from the body alone.	2 / 3
Workflow Clarity	Clear staged progression (Map → Trace → Hunt) with a Stages table and explicit MUST-GATE checkpoints plus confidence-based verification; not score 2 because checkpoints are explicit rather than missing or implicit.	3 / 3
Progressive Disclosure	Well-sectioned overview that signals detail files ("map.md", "stage-specific files"), but no bundle files exist so those references do not resolve; not score 3 because one-level-deep references must point to real files, not score 1 because the body is well organized rather than monolithic.	2 / 3
	Total	9 / 12 Passed

Description

60%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and action-oriented but misses an explicit Use-when trigger clause and relies on somewhat technical phrasing, limiting trigger quality and completeness.

Suggestions

Add an explicit "Use when..." clause with natural user phrases (e.g., "Use when you need to understand unfamiliar code, trace how untrusted input reaches a sink, or find variants of a known vulnerability").

Soften jargon ("adversarial code comprehension", "ground-truth understanding") toward terms users actually say, such as "understand code", "review code for vulnerabilities", or "trace data flows".

Strengthen distinctiveness by naming the concrete trigger conditions that separate this from a general code-reading or scanning skill.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — "mapping architecture, tracing data flows, and hunting vulnerability variants" — matching the anchor for several specific concrete actions; not score 2 because more than a domain plus partial actions are named.	3 / 3
Completeness	Clearly states what the skill does, but the only timing cue is "before or alongside static analysis" with no explicit "Use when..." trigger clause, which caps completeness at 2 per the guidelines; not score 1 because the what is well covered.	2 / 3
Trigger Term Quality	Contains relevant terms ("security research", "static analysis", "vulnerability variants") but leans technical ("adversarial code comprehension", "ground-truth understanding") and omits common natural phrasings a user would say; not score 3 because natural-term coverage is incomplete.	2 / 3
Distinctiveness Conflict Risk	The security-research framing carves a niche but lacks crisp explicit triggers and could overlap with general code-review/understanding skills; not score 3 because distinctiveness relies on implicit context rather than differentiated triggers.	2 / 3
	Total	9 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: gadievron/raptor
Path: .claude/skills/code-understanding/SKILL.md
Commit: 75f6956

Reviewed: 7 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.