exploitability-validation

Multi-stage pipeline for validating that vulnerability findings are real, reachable, and exploitable, preventing wasted effort on hallucinated findings, dead code paths, or findings with unrealistic preconditions.

Quality

64%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./.claude/skills/exploitability-validation/SKILL.md

Quality

Content

70%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content delivers a well-sequenced, validation-rich pipeline with concrete executable commands, but it inlines reference-level detail (notably the SMT section) and references stage files that are absent from the bundle.

Suggestions

Move the SMT/Z3 architecture and constraint-form detail into a dedicated reference file and keep only a brief signpost in SKILL.md to improve conciseness and progressive disclosure.

Provide the referenced stage-specific files (stage-e-feasibility.md, web-profile.md, checklist.json) in ./references/ so the signaled navigation resolves to real content.

Extract the Style/Formatting and MUST-GATEs sections into supporting reference docs, leaving the overview focused on the stage flow and execution rules.

Dimension	Reasoning	Score
Conciseness	Mostly efficient operational prose, but the inlined SMT/Z3 section (architecture layers, constraint forms, JSON schema, integration notes) is reference-level detail that pads the overview and could be tightened or moved to a separate file.	3 / 5
Actionability	Provides concrete commands (libexec/raptor-validate-schema, raptor-run-sandboxed), exact Python import snippets, stage-file naming, and a provenance JSON stamp — mostly executable guidance with minor gaps where referenced stage files are not present in the bundle.	4 / 5
Workflow Clarity	The pipeline is explicitly sequenced across Stages 0–F plus Stage 1 with a phase table and flow diagram, and embeds strong validation checkpoints (schema validation after each Write, fix-before-proceeding feedback loops, and MUST-GATE checklists).	5 / 5
Progressive Disclosure	The body signals one-level-deep references to stage-specific files, but no bundle files (references/scripts/assets) exist to back them, and substantial detail (SMT add-on, style rules, gates) is inlined rather than split out.	3 / 5
	Total	15 / 20 Passed

Description

58%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and distinct, clearly conveying a validation pipeline for vulnerability findings, but it omits an explicit 'when to use' trigger clause and leans on technical jargon over natural user phrasing.

Suggestions

Add an explicit 'Use when...' clause stating when to invoke the skill, e.g. after scanning produces findings and before exploit development.

Introduce more natural trigger terms a user would say ('validate findings', 'confirm a vuln is real', 'triage scanner output') alongside the technical jargon.

Soften abstract verbs by naming concrete pipeline actions (verify reachability, reproduce the PoC, rule out false positives) to push specificity toward 5.

Dimension	Reasoning	Score
Specificity	Names the domain and lists several concrete validation aspects — findings being 'real, reachable, and exploitable' plus three distinct failure modes (hallucinated findings, dead code paths, unrealistic preconditions) — with only minor abstraction in the verbs.	4 / 5
Completeness	Clearly answers 'what' (multi-stage validation pipeline) but provides no explicit 'Use when...' trigger clause, so per the missing-trigger cap completeness cannot exceed 3.	3 / 5
Trigger Term Quality	Contains relevant domain keywords ('vulnerability findings', 'exploitable', 'dead code paths', 'preconditions') but lacks the natural variations or synonyms a user would actually say and offers no colloquial phrasing.	3 / 5
Distinctiveness Conflict Risk	The exploitability-validation niche is clearly scoped and unlikely to fire for unrelated skills, with only minor overlap risk against general vulnerability-scanning skills.	4 / 5
	Total	14 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: gadievron/raptor
Path: .claude/skills/exploitability-validation/SKILL.md
Commit: 4e75ac9

Reviewed: 4 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.