sast-rce

Detect Remote Code Execution (RCE) vulnerabilities in a codebase using a three-phase approach: recon (find dangerous execution sinks), batched verify (trace user input to sinks in parallel subagents, 3 sinks each), and merge (consolidate batch results). Covers OS command injection, eval-like sinks, and unsafe deserialization. Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/rce-results.md. Use when asked to find RCE, command injection, or unsafe deserialization bugs.

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

77%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

Highly actionable with an excellent, well-validated multi-phase workflow, but the content is verbose for the context window and monolithic with no internal progressive disclosure structure.

Suggestions

Trim or remove the 'What is Remote Code Execution' concept introduction and root-cause preamble; Claude already knows this and it competes with the context window.

Move the large per-language vulnerable/secure example catalog into a references/ file (e.g. references/examples.md) and keep only a concise pointer plus the tech-stack selection guidance in SKILL.md.

Consider extracting the Phase 1 sink-by-language reference list into a separate reference file to reduce SKILL.md length while preserving the actionable workflow in the main body.

Dimension	Reasoning	Score
Conciseness	The body is ~700 lines and the 'What is Remote Code Execution' section explains a concept Claude already knows, while the exhaustive inline multi-language example catalog adds bulk; however the discriminating 'What RCE is NOT' and classification guidance are genuinely useful, so it is mostly efficient rather than fully lean.	2 / 3
Actionability	Provides executable vulnerable/secure code per language, explicit per-language sink lists, a concrete batching procedure, and exact copy-paste-ready output-format templates for recon, batch, and merge files.	3 / 3
Workflow Clarity	A clearly sequenced three-phase workflow with an explicit validation checkpoint after Phase 1 (zero sinks → skip Phases 2–3 and write a 'No vulnerabilities found' report), parallel batching, a merge procedure, and intermediate-file cleanup steps.	3 / 3
Progressive Disclosure	No bundle files exist (references/scripts/assets absent) and the skill is a single monolithic ~700-line file; the large example catalog that could live in a separate reference is inline, and the only referenced path (sast/architecture.md) is an external prerequisite rather than internal progressive disclosure.	2 / 3
	Total	10 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that clearly conveys both capability and trigger conditions with concrete actions and natural keywords. Third-person voice is maintained throughout.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'recon (find dangerous execution sinks)', 'batched verify (trace user input to sinks in parallel subagents, 3 sinks each)', 'merge (consolidate batch results)' — across named vulnerability classes (OS command injection, eval-like sinks, unsafe deserialization).	3 / 3
Completeness	It explicitly states what the skill does (three-phase RCE detection covering specific classes, with prerequisites and output location) and when to use it via an explicit 'Use when...' trigger.	3 / 3
Trigger Term Quality	The clause 'Use when asked to find RCE, command injection, or unsafe deserialization bugs' covers the natural terms a user would actually say when requesting this kind of analysis.	3 / 3
Distinctiveness Conflict Risk	The RCE-only niche, distinctive triggers, and explicit prerequisite ('Requires sast/architecture.md (run sast-analysis first)') make it unlikely to trigger for the wrong skill.	3 / 3
	Total	12 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (714 lines); consider splitting into references/ and linking	Warning

	Total	15 / 16 Passed

Repository: utkusen/sast-skills
Path: sast-files/.agents/skills/sast-rce/SKILL.md
Commit: db52227

Reviewed: about 19 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.