oss-forensics-orchestration

Orchestrates multi-agent forensic investigations on public GitHub repositories, coordinating parallel evidence collection, hypothesis formation, verification, and report generation.

Quality

72%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./.claude/skills/oss-forensics/orchestration/SKILL.md

Quality

Content

77%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is a well-sequenced, highly actionable orchestration workflow with strong validation and feedback loops. Its main weaknesses are mild redundancy (Critical Rules restate the phases) and a monolithic structure that keeps everything inline rather than splitting detailed agent-prompt templates into reference files.

Suggestions

Remove or trim the 'Critical Rules' and 'Example Execution' sections where they restate phase content, to tighten token usage.

Extract the per-agent prompt templates (Phase 2 and the loop pseudocode) into a reference file (e.g. agents.md) referenced one level deep, so SKILL.md stays a lean overview.

Define how an evidence-request file is parsed (agent name + query extraction) concretely instead of leaving extract_agent_from_request/extract_query_from_request as undefined helpers.

Dimension	Reasoning	Score
Conciseness	The body is largely procedural and assumes Claude's competence (no explaining what GitHub/forensics is), but the 'Critical Rules' section restates guidance already embedded in the phases and the 'Example Execution' block is illustrative padding. Not level 3 due to this redundancy; not level 1 because it is not padded with concepts Claude already knows.	2 / 3
Actionability	Provides concrete, copy-paste-ready Task spawn templates with exact agent identifiers and prompt structures, plus a fully executable init command ('source .venv/bin/activate && python .../init_investigation.py') and exact output artifact paths. The Phase 3/5 loop blocks use pseudocode, but that is justified control-flow description for an orchestration skill and wraps concrete sub-actions; per the scoring notes, actionable instruction-style guidance is not penalized for lacking executable code.	3 / 3
Workflow Clarity	Seven phases are explicitly sequenced (0–7) with clear validation checkpoints: prerequisite check in Phase 0 ('If prerequisites fail, STOP'), a dedicated verifier in Phase 4, and feedback loops in Phases 3 and 5 (hypothesis→rebuttal→revise with retry limits), plus an Error Handling section. Not level 2 because validation and feedback loops are explicit, not implicit.	3 / 3
Progressive Disclosure	Sections are well-organized into labeled phases, but the skill is a monolithic single file (~260 lines) with all agent-prompt templates, rules, and examples inline and no file-based references. Not level 3 because it exceeds 50 lines with no one-level-deep reference files; not level 1 because it is structured, not a wall of text.	2 / 3
	Total	10 / 12 Passed

Description

67%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and distinctive, naming a clear niche and several concrete actions, but it lacks an explicit 'when to use' trigger and its keywords are more technical than user-natural. Adding a 'Use when...' clause with common user phrasings would raise completeness and trigger quality.

Suggestions

Append a 'Use when...' clause, e.g. 'Use when investigating suspected malicious activity, supply-chain compromise, or anomalous actor behavior on a public GitHub repository.'

Soften jargon and add natural trigger terms users would actually say, such as 'investigate', 'audit', 'attributed to', or 'suspicious commits/PRs'.

Keep the concrete action list but ensure the trigger phrasing mirrors how a user would request the investigation.

Dimension	Reasoning	Score
Specificity	Lists multiple specific concrete actions — 'parallel evidence collection, hypothesis formation, verification, and report generation' — anchored to a concrete domain ('public GitHub repositories'). Not level 2 because the action list is comprehensive rather than partial.	3 / 3
Completeness	Clearly answers 'what' the skill does, but offers no 'Use when...' clause or equivalent explicit trigger guidance for when to invoke it. Capped at 2 per the missing-trigger guideline; not level 1 because the 'what' is strong and specific.	2 / 3
Trigger Term Quality	Contains relevant domain keywords ('forensic investigations', 'GitHub repositories', 'evidence collection') but leans technical/jargony ('orchestrates multi-agent', 'hypothesis formation') and omits common user phrasings like 'investigate', 'audit', or 'suspected compromise'. Not level 3 because trigger coverage is not natural/user-facing; not level 1 because genuine domain keywords are present.	2 / 3
Distinctiveness Conflict Risk	Targets a clear, narrow niche ('multi-agent forensic investigations on public GitHub repositories') with distinct vocabulary, making accidental triggering by unrelated skills unlikely. Not level 2 because it is specific rather than overlapping.	3 / 3
	Total	10 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: gadievron/raptor
Path: .claude/skills/oss-forensics/orchestration/SKILL.md
Commit: 75f6956

Reviewed: 7 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.