oss-forensics-orchestration

Orchestrates multi-agent forensic investigations on public GitHub repositories, coordinating parallel evidence collection, hypothesis formation, verification, and report generation.

Quality

59%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./.claude/skills/oss-forensics/orchestration/SKILL.md

Quality

Content

60%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body lays out a clear, well-sequenced seven-phase orchestration with real validation and feedback loops, but loses points to pseudocode Task templates with placeholders and redundant Critical Rules / Example Execution sections that could be tightened.

Suggestions

Replace the pseudocode `Task:` blocks with the real Agent/Task tool-call format and resolve placeholders (e.g., show how <research question> and <workdir> are substituted) to move actionability toward executable guidance.

Trim the 'Critical Rules' section to only non-duplicate rules and cut or relocate the 'Example Execution' block to reduce redundancy and token cost.

Add an explicit checkpoint after Phase 2 verifying that each investigator returned evidence before entering hypothesis formation, which would close the main workflow-clarity gap.

Dimension	Reasoning	Score
Conciseness	The phase structure is mostly efficient and assumes Claude's competence, but the 'Critical Rules' section largely restates workflow steps already covered ('spawn in parallel', 'wait for completion', 'pass working directory') and the 'Example Execution' block is illustrative redundancy that could be trimmed, placing it at the 'could be tightened' anchor rather than a 4.	3 / 5
Actionability	Concrete agent names, prompt templates, the executable init command, and file-naming conventions are provided, but the spawn blocks use pseudocode `Task:` syntax with unfilled placeholders (`<research question>`, `<workdir>`) rather than real executable tool calls, and how evidence summaries are derived or agent outputs parsed is left implicit — the 'pseudocode instead of executable code' anchor fits best.	3 / 5
Workflow Clarity	Seven phases are clearly sequenced with explicit validation (Phase 4 verifier, Phase 5 checker) and a genuine rebuttal→revise feedback loop plus error handling and max-retry limits; it falls short of 5 only because Phase 2→3 lacks a checkpoint confirming investigators actually returned evidence before hypothesis formation.	4 / 5
Progressive Disclosure	No bundle files exist, so all content is inline, but it is organized into well-signaled phase sections with consistent headers and clear navigation; the structure is good and appropriately scoped for a single-file orchestrator, with only minor gaps (the agent prompt templates could live in reference files) keeping it below 5.	4 / 5
	Total	14 / 20 Passed

Description

58%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and distinctive, clearly conveying what the skill orchestrates and naming concrete phases, but it lacks an explicit 'Use when...' trigger clause and natural synonyms, which caps both completeness and trigger-term quality at 3.

Suggestions

Append an explicit trigger clause, e.g. 'Use when investigating suspicious activity, supply-chain incidents, or actor behavior on a public GitHub repository.'

Add natural synonyms users would actually say — 'audit', 'analyze', 'investigate' — alongside 'forensic investigations' to improve trigger-term coverage.

Optionally name the deliverable trigger ('when the user asks for a forensic report with timeline, attribution, and IOCs') to strengthen the 'when' half of completeness.

Dimension	Reasoning	Score
Specificity	Names the domain ('forensic investigations on public GitHub repositories') and lists several concrete actions — 'parallel evidence collection, hypothesis formation, verification, and report generation' — which is comprehensive for an orchestration skill, though the actions are process phases rather than atomic operations, keeping it just below a 5.	4 / 5
Completeness	It clearly answers 'what does this do', but the 'when should Claude use it' half is missing — there is no 'Use when...' clause or equivalent explicit trigger guidance, which per the judging guidelines caps completeness at 3.	3 / 5
Trigger Term Quality	Relevant keywords are present ('forensic investigations', 'GitHub repositories', 'evidence collection'), but it omits common variations a user might actually say ('audit', 'analyze', 'investigate this repo', 'security review') and has no explicit 'Use when...' trigger phrase, leaving it at the 'some relevant keywords, missing synonyms' anchor rather than a 4.	3 / 5
Distinctiveness Conflict Risk	The niche ('multi-agent forensic investigations on public GitHub repositories') is clear and fairly distinct, with low overlap risk; a minor risk remains because 'investigations' is broad and could brush against general code-analysis skills, so it sits just below a 5.	4 / 5
	Total	14 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: gadievron/raptor
Path: .claude/skills/oss-forensics/orchestration/SKILL.md
Commit: 4e75ac9

Reviewed: 4 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.