Name: sast-rce
Rating: 67.2 (1 reviews)
Author: utkusen

sast-rce

Detect Remote Code Execution (RCE) vulnerabilities in a codebase using a three-phase approach: recon (find dangerous execution sinks), batched verify (trace user input to sinks in parallel subagents, 3 sinks each), and merge (consolidate batch results). Covers OS command injection, eval-like sinks, and unsafe deserialization. Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/rce-results.md. Use when asked to find RCE, command injection, or unsafe deserialization bugs.

Quality

81%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

The canonical home for this skill is sast-rce in utkusen/sast-skills

Quality

Content

71%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-sequenced security workflow with strong validation gating, weakened mainly by verbosity from duplicated reference material and by inlining large per-language catalogs that would be better split into reference files.

Suggestions

Move the per-language sink catalogs and vulnerable/secure examples into reference files (e.g. references/sinks.md, references/examples.md) and link to them from SKILL.md to cut inlined bulk and reduce duplication with the subagent instruction templates.

Deduplicate the 'What RCE is NOT' guidance so it lives in one place and is referenced from the Phase 2 subagent template rather than restated verbatim.

Add an explicit verification step before the Phase 3 merge that checks each sast/rce-batch-N.md exists and is well-formed, with a fallback (e.g., re-run the failed batch or mark its sinks as Needs Manual Review) if a batch subagent produced no or malformed output.

Dimension	Reasoning	Score
Conciseness	The body is concrete domain reference rather than generic fluff, but it carries notable duplication: the 'What RCE is NOT' list appears in the preamble and is restated inside the Phase 2 subagent template, and the vulnerable/secure examples are both inlined and re-injected via [TECH-STACK EXAMPLES]. These could be tightened by referencing a single source.	3 / 5
Actionability	Provides fully executable guidance — per-language sink catalogs, copy-paste subagent instruction blocks, exact markdown output templates, concrete file paths (sast/rce-recon.md, sast/rce-batch-N.md, sast/rce-results.md), an explicit batching procedure, and dynamic-test payload examples.	5 / 5
Workflow Clarity	The three phases are clearly sequenced with an explicit validation checkpoint after Phase 1 (the zero-sink gate that skips Phases 2-3 and writes 'No vulnerabilities found') and a cleanup step in Phase 3, but there is no handling for a failed or malformed batch subagent output before the merge.	4 / 5
Progressive Disclosure	Section headers give the document structure, but no bundle files exist and large per-language sink catalogs plus per-language vulnerable/secure examples are inlined in SKILL.md — material that clearly belongs in separate reference files such as references/sinks.md or references/examples.md.	3 / 5
	Total	15 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that clearly states both capability and trigger conditions in third-person voice, with concrete phase-level actions and a well-scoped vulnerability niche. The only gap is a few missing natural synonyms in the trigger clause.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions across the three phases ('find dangerous execution sinks', 'trace user input to sinks in parallel subagents, 3 sinks each', 'consolidate batch results') plus three covered vulnerability classes, giving comprehensive coverage rather than a single generic action.	5 / 5
Completeness	Explicitly answers both 'what' (detect RCE via a three-phase recon/verify/merge approach covering three vulnerability classes) and 'when' ('Use when asked to find RCE, command injection, or unsafe deserialization bugs') with concrete trigger phrases.	5 / 5
Trigger Term Quality	Includes natural trigger terms users would say ('RCE', 'command injection', 'unsafe deserialization') in the 'Use when asked to find RCE, command injection, or unsafe deserialization bugs' clause, but omits common synonyms such as 'code injection', 'eval injection', or 'pickle/Marshal deserialization'.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (RCE detection) with distinct triggers that separate it from sibling vulnerability classes (SQLi, XSS, SSRF, SSTI), and the enumerated scope keeps conflict risk minimal despite being part of a broader sast suite.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (714 lines); consider splitting into references/ and linking	Warning

	Total	15 / 16 Passed

Repository: utkusen/sast-skills
Path: sast-files/.claude/skills/sast-rce/SKILL.md
Commit: db52227

Reviewed: 33 minutes ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.