exploitability-validation

Multi-stage pipeline for validating that vulnerability findings are real, reachable, and exploitable, preventing wasted effort on hallucinated findings, dead code paths, or findings with unrealistic preconditions.

Quality

65%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./.claude/skills/exploitability-validation/SKILL.md

Quality

Content

62%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body excels at workflow sequencing and validation gates, but its actionable detail depends on stage files that are not in the bundle, and it carries verbosity plus inline content that would benefit from being split out. Progressive disclosure is undermined by references to absent files.

Suggestions

Bundle the referenced stage-specific files (stage-*.md, libexec/raptor-*, packages/exploit_feasibility) or move their essential per-stage steps inline so the skill is self-contained.

Move the detailed SMT/Z3 add-on section into a separate reference file and keep only a brief pointer plus the integration contract in SKILL.md.

Remove redundancy: drop the Purpose section (already in the frontmatter) and consolidate [REMIND] with the MUST-GATEs.

Dimension	Reasoning	Score
Conciseness	Mostly operational and dense, but ~290 lines with redundancy — the Purpose section restates the frontmatter and [REMIND] repeats the MUST-GATEs, while the SMT add-on section is verbose inline.	2 / 3
Actionability	Provides concrete libexec commands and an executable Python snippet, but the core per-stage actionable detail is deferred to 'stage-specific files' that are not present in the bundle, leaving key steps unspecified in this file.	2 / 3
Workflow Clarity	Stages 0–F–1 are explicitly sequenced with X0/X/X1 phases, a flow diagram, schema validation after each write, and clear feedback loops (e.g. 'Fix any errors before proceeding').	3 / 3
Progressive Disclosure	No bundle files exist, yet the body references stage-.md, libexec/raptor-, and packages/exploit_feasibility paths that are not bundled; the detailed SMT add-on is inline rather than split into a reference file.	2 / 3
	Total	9 / 12 Passed

Description

67%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and occupies a distinct niche, but it lacks an explicit 'Use when...' trigger and leans on internal jargon rather than natural user phrasing. It states the 'what' well but not the 'when'.

Suggestions

Add an explicit 'Use when...' clause naming natural triggers, e.g. 'Use when validating scanner findings before exploit development, or when a finding's reachability or exploitability is uncertain.'

Soften jargon ('hallucinated findings', 'dead code paths') toward terms users actually say, such as 'false positives', 'unreachable code', and 'unrealistic preconditions'.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'validating that vulnerability findings are real, reachable, and exploitable' plus preventing wasted effort on 'hallucinated findings, dead code paths, or findings with unrealistic preconditions'.	3 / 3
Completeness	Clearly states what the skill does, but there is no 'Use when...' clause or equivalent explicit trigger guidance, which caps completeness at 2 per the judging guidelines.	2 / 3
Trigger Term Quality	Uses domain jargon ('hallucinated findings', 'dead code paths', 'unrealistic preconditions') with some relevant keywords ('vulnerability findings', 'exploitable') but no natural user-facing trigger phrasing or common variations.	2 / 3
Distinctiveness Conflict Risk	A clear niche (exploitability validation of vulnerability findings) with triggers unlikely to overlap with unrelated skills.	3 / 3
	Total	10 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: gadievron/raptor
Path: .claude/skills/exploitability-validation/SKILL.md
Commit: 75f6956

Reviewed: 7 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.