CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

exploitability-validation

Multi-stage pipeline for validating that vulnerability findings are real, reachable, and exploitable, preventing wasted effort on hallucinated findings, dead code paths, or findings with unrealistic preconditions.

Quality

73%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./.claude/skills/exploitability-validation/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

62%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body delivers a highly actionable, well-sequenced pipeline with strong validation feedback loops — its strongest qualities. It is dragged down by noticeable verbosity (redundant reminder/rationale sections and inlined reference-grade detail) and a progressive-disclosure structure that promises stage files the bundle does not actually contain.

Suggestions

Move the SMT/Z3 add-on section and the sharding workflow into separate reference files, keeping only a short summary and a pointer in SKILL.md.

Delete the redundant "[REMIND] Critical Reminders" section and the "Rationale" preamble — both restate rules already given in GATE-1/5/6 and EXEC.

Either ship the referenced stage files (stage-e-feasibility.md, web-profile.md, stage-specific docs) in the bundle or remove/inline the pointers so navigation does not dead-end.

DimensionReasoningScore

Conciseness

The 370-line body has several padded or redundant sections: "[REMIND] Critical Reminders" restates GATE-1/5/6, a "Rationale" paragraph explains generic model behavior, the ~50-line SMT/Z3 section details constraint forms and output schemas, and a "Notice" section adds no operational value. Not 1 — the majority of the content is non-obvious operational rule-making that earns its tokens.

2 / 5

Actionability

Concrete executable guidance dominates: exact commands ("libexec/raptor-validate-schema --lint part-<x> <file>", "libexec/raptor-run-sandboxed --output-dir ... <cmd>"), exact provenance JSON stamps, exact status-mapping tables, and a full manual code example. Minor gaps: the "Automatic (via Stage E)" block is a comment-only placeholder, and stage-specific files are referenced without paths.

4 / 5

Workflow Clarity

Eight stages are explicitly sequenced with a phase table (X0/X/X1), a flow diagram, per-stage schema validation, mandatory post-Write validation with fix-before-proceeding, and an error-recovery loop (quarantine, bounded re-dispatch, receipt-gated merges) with explicit validation checkpoints. This matches the top anchor including feedback loops and checklists.

5 / 5

Progressive Disclosure

The bundle contains only SKILL.md, yet the body references stage-specific files, "web-profile.md", "stage-e-feasibility.md", and ".claude/commands/validate.md" that are not present in the skill, while reference-grade content (SMT constraint encoding, sharding rules, output formatting) is inlined. Not 4 — the split between overview and detail files is not realized; not 2 — the section structure, tables, and flow diagram do provide navigable organization.

3 / 5

Total

14

/

20

Passed

Description

71%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is concrete and domain-specific, clearly stating what the pipeline validates and which failure modes it prevents. Its main weakness is the complete absence of a "when to use" trigger clause, which caps completeness and leaves natural trigger phrasing implicit.

Suggestions

Add an explicit trigger clause, e.g. "Use when a scanner or code review has produced vulnerability findings and before acting on or exploiting them."

Include natural synonyms users would actually say — "false positives", "triage findings", "verify a finding is real" — to broaden trigger coverage.

Mention when NOT to use it (e.g. not for initial scanning) to sharpen distinctiveness against general security-review skills.

DimensionReasoningScore

Specificity

"validating that vulnerability findings are real, reachable, and exploitable" plus "hallucinated findings, dead code paths, or findings with unrealistic preconditions" names multiple concrete validation actions and the failure modes they filter, giving comprehensive coverage for this domain. Neighboring anchor 4 ("minor gaps in coverage") fits less well since the description enumerates both the actions and their targets.

5 / 5

Completeness

The "what" is clear (a multi-stage validation pipeline and the failure modes it filters), but there is no "Use when..." clause or equivalent explicit trigger guidance, which caps completeness at 3 per the judging guidelines. Not 2 — the "what" half is concrete, not vague.

3 / 5

Trigger Term Quality

"vulnerability findings", "validating", "exploitable" are natural terms a security user would say, but common synonyms like "false positives", "triage", or "verify findings" are missing. Not 3 — the keyword coverage is good, not just "some relevant keywords"; not 5 — no synonym variation is offered.

4 / 5

Distinctiveness Conflict Risk

The exploitability-validation niche (real/reachable/exploitable, dead code paths, unrealistic preconditions) is mostly distinct, with minor overlap risk against general security-review or finding-triage skills. Not 5 — "validating findings" could compete with broader review/triage skills in edge cases.

4 / 5

Total

16

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

gadievron/raptor

Path

.claude/skills/exploitability-validation/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.