exploitability-validation

Multi-stage pipeline for validating that vulnerability findings are real, reachable, and exploitable, preventing wasted effort on hallucinated findings, dead code paths, or findings with unrealistic preconditions.

Quality

64%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./.claude/skills/exploitability-validation/SKILL.md

Quality

Content

70%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body delivers a well-sequenced, actionable pipeline with strong validation checkpoints, but it is verbose in places and inlines detailed material (notably the SMT add-on) that would be better split into reference files. Navigation is undermined by missing and vaguely named references.

Suggestions

Move the detailed SMT/Z3 add-on section into a dedicated reference file and leave a concise pointer plus the key integration facts in SKILL.md.

Replace vague pointers like 'See stage-specific files' with named file paths so navigation is unambiguous, and ensure those referenced files actually exist.

Trim the duplicated Purpose/When-to-Use restatement and the boilerplate defensive-purpose notice to reduce token overhead.

Dimension	Reasoning	Score
Conciseness	Much of the operational detail earns its place, but the body is padded with a duplicated Purpose/When-to-Use restatement, gate rationale prose, and a boilerplate defensive-purpose notice that could be trimmed.	3 / 5
Actionability	Provides concrete commands (raptor-validate-schema, raptor-run-sandboxed), an exact python import prefix, a literal provenance JSON stamp, and an executable analyze_binary example, with only minor gaps in coverage.	4 / 5
Workflow Clarity	Stages 0 through 1 are explicitly sequenced with a flow diagram and X0/X/X1 phase table, and a validate-after-write feedback loop ('Fix any errors before proceeding to the next stage') provides explicit validation checkpoints.	5 / 5
Progressive Disclosure	Section headers and some one-level references exist, but referenced files are absent (no bundle directories), several references are vague ('See stage-specific files'), and the lengthy inlined SMT/Z3 section reads as content that belongs in a separate reference file.	3 / 5
	Total	15 / 20 Passed

Description

58%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description gives a clear, reasonably specific picture of what the skill does and occupies a distinct niche, but lacks explicit 'when to use' trigger guidance and leans on technical jargon over natural user phrasing. It is solid but not exemplary.

Suggestions

Add an explicit 'Use when...' clause stating when this skill should be invoked (e.g., after scanning produces findings and before exploit development).

Include more natural trigger phrases and synonyms a user might say, such as 'validate vulnerabilities', 'confirm a finding is real', or 'check exploitability'.

Briefly name the pipeline stages so the scope of 'multi-stage' is concrete rather than abstract.

Dimension	Reasoning	Score
Specificity	Names the domain plus several concrete validation actions ('real, reachable, and exploitable'; 'hallucinated findings, dead code paths... unrealistic preconditions'), but does not enumerate the pipeline stages, leaving a minor coverage gap versus a 5.	4 / 5
Completeness	A clear 'what' is present ('multi-stage pipeline for validating...'), but there is no explicit 'Use when...' trigger clause, which per the rubric caps completeness at 3.	3 / 5
Trigger Term Quality	Terms like 'vulnerability findings', 'exploitable', and 'dead code paths' are domain-relevant but jargon-heavy, and common synonyms or natural phrasings a user would actually say are missing.	3 / 5
Distinctiveness Conflict Risk	The exploitability-validation niche is clearly distinguishable from scanning or exploit development, with only minor overlap risk against a related 'exploit feasibility' skill.	4 / 5
	Total	14 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: gadievron/raptor
Path: .claude/skills/exploitability-validation/SKILL.md
Commit: a5deef3

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.