CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

vulnerability-writeup

Turn vulnerability notes, disclosure reports, PoCs, source code, or Codex Security findings into self-contained, sceptically validated, natural-sounding vulnerability reports. Use for one vulnerability or a disclosure campaign; a Codex Security scan is optional.

69

Quality

87%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

81%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

An unusually rigorous instruction-only skill: fully actionable templates, a validation-gated workflow with repair loops, and a real one-level-deep reference for report format. Its main cost is token weight — core rules are repeated three to four times across the rules, drafting-prompt, and acceptance sections, which could be consolidated without losing any constraint.

Suggestions

State each repeated rule once: the "witness" ban, actor-naming convention, absolute-path ban, and report-only conditionality each appear in "Non-negotiable rules", the drafting prompt, and "Report acceptance"; consolidate them into a single authoritative section and have the acceptance checklist reference the rule names instead of restating them.

Deduplicate the release-history guidance that appears in both "Trace affected release history" and the drafting prompt's third paragraph, keeping the full procedure in one place and a one-line summary in the other.

Trim the overlap between "Source and exploitability standard" and the drafting prompt's causal-order and fix-verification paragraphs, which restate the same requirements in near-identical wording.

DimensionReasoningScore

Conciseness

Every rule is skill-specific policy rather than concepts Claude already knows, but the same rules are restated across sections — the "witness" ban (lines 27, 138, 178), actor naming (lines 31, 36, 136, 179), the absolute-path ban (lines 32, 116, 142, 182), and report-only conditionality (lines 23, 128, 144, 169) — so the body could be tightened by roughly a third. It is mostly efficient but noticeably redundant between "Non-negotiable rules", the drafting prompt, and "Report acceptance".

3 / 5

Actionability

The skill supplies a copy-paste-ready fill-in-the-blank single-finding drafting prompt, a rewrite prompt template for failed drafts, exact output paths (`findings/<slug>/<slug>.md`), a concrete git command (`git show REV:PATH`), fixed actor/username conventions (alice/bob/mallory/eve), worked phrasing examples, and explicit stall and delegation-failure protocols.

5 / 5

Workflow Clarity

The 10-step campaign workflow is clearly sequenced with explicit validation checkpoints (step 7 independent re-reading against artefacts, step 8 enumerated reject criteria), a repair feedback loop (step 9: fresh sub-agent with specific failures), a full acceptance checklist, and defined handling for unavailable delegation and stalled workers.

5 / 5

Progressive Disclosure

Report-format detail is properly externalized to the clearly-signaled, one-level-deep `references/report-format.md`, which exists in the bundle. However, the ~184-line body still inlines the complete drafting-prompt template and long policy sections that could be split out, and the `../../references/artifact-storage.md` pointer resolves outside the bundle.

4 / 5

Total

17

/

20

Passed

Description

87%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description: it explicitly states what the skill does, when to use it, and its scope boundary (a Codex Security scan is optional), in third-person voice with domain-natural trigger terms. The only weakness is that capability coverage rests on one transformation action rather than an enumeration of several distinct actions.

DimensionReasoningScore

Specificity

"Turn vulnerability notes, disclosure reports, PoCs, source code, or Codex Security findings into self-contained, sceptically validated, natural-sounding vulnerability reports" names the domain with a comprehensive enumeration of inputs and output qualities, but the action list reduces to a single transformation verb rather than multiple distinct concrete actions.

4 / 5

Completeness

The 'what' is explicit ("Turn … into self-contained, sceptically validated, natural-sounding vulnerability reports") and the 'when' is explicit with concrete trigger phrases ("Use for one vulnerability or a disclosure campaign; a Codex Security scan is optional").

5 / 5

Trigger Term Quality

Natural terms a user would say — "vulnerability", "disclosure reports", "PoCs", "source code", "Codex Security" — are present, but common synonyms such as "advisory", "CVE", or "responsible disclosure" are missing, so coverage is good rather than comprehensive.

4 / 5

Distinctiveness Conflict Risk

Vulnerability disclosure report writing is a clear niche with distinct triggers (vulnerability notes, disclosure reports, PoCs, Codex Security findings), so the risk of firing for an unrelated skill is minimal.

5 / 5

Total

18

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

openai/plugins

Path

plugins/codex-security/skills/vulnerability-writeup/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.