CtrlK
BlogDocsLog inGet started
Tessl Logo

competition-bundle-sourcemap-recovery

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for source maps, build manifests, chunk registries, emitted bundles, obfuscated loader flow, and frontend runtime recovery. Use when the user asks to reconstruct served JavaScript structure, inspect source maps or chunk maps, trace bundle loading, recover hidden routes or APIs from emitted assets, or explain runtime behavior from built frontend artifacts. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.

70

Quality

86%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Low

Low-risk findings worth noting

SKILL.md
Quality
Evals
Security

Quality

Content

72%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is well-organized and token-efficient with good progressive disclosure to a real reference file, but its deeper investigative steps ('reconstruct the smallest runtime graph', 'reproduce the smallest asset-to-runtime boundary') are abstract and lack executable examples or explicit validation feedback loops.

Suggestions

Add one concrete worked example or runnable snippet (e.g., a sample source-map→original-symbol lookup or a chunk-loader trace) so the 'Reconstruct' and 'Reproduce' steps have executable specifics rather than abstractions.

Promote step 5 into an explicit validation checkpoint with a re-check loop — e.g., 'Verify: confirm the recovered symbol is actually invoked by the currently served bundle; if not, return to step 2' — instead of leaving verification implicit.

For each Workflow phase, name the specific artifact or tool action that produces the output (e.g., 'parse the source map with source-map-explorer to map chunk ids to original modules') to lift actionability from described to instructed.

DimensionReasoningScore

Conciseness

The ~45-line body is lean and efficient, never explaining concepts Claude already knows (no 'what a source map is'), and every line carries instruction; it does not reach the verbose score-2 anchor of unnecessary explanation.

3 / 3

Actionability

It names concrete artifacts to record ('entry HTML, script tags, preload hints, manifest files, asset map, chunk registry, and source map URLs') but several core steps stay abstract ('Reconstruct the smallest runtime graph that explains which asset executes now', 'Reproduce the smallest asset-to-runtime boundary') with no executable examples or commands. It is more specific than the score-1 'describe rather than instruct' anchor but lacks the copy-paste-ready specificity of score 3.

2 / 3

Workflow Clarity

A clear numbered sequence exists (Quick Start steps 1–5 plus a 3-phase Workflow), but validation checkpoints are implicit rather than explicit — step 5's 'proves the decisive behavior' is a proof step yet there is no structured validate-then-retry feedback loop. This fits 'sequence present but checkpoints missing or implicit' better than the explicit-checkpoint score-3 anchor.

2 / 3

Progressive Disclosure

A concise overview body points via a clearly signaled one-level-deep reference ('Load `references/bundle-sourcemap-recovery.md` for the artifact checklist, deobfuscation checklist, and evidence packaging') to a real, non-nested file (verified present), with content appropriately split between overview and reference.

3 / 3

Total

10

/

12

Passed

Description

100%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description that follows the recommended pattern: it states concrete capabilities, gives explicit 'Use when' triggers with natural domain terms, and bounds the skill to a distinct niche via orchestrator routing. It is concise and avoids fluff or over-claims.

DimensionReasoningScore

Specificity

Lists multiple specific concrete actions — 'reconstruct served JavaScript structure, inspect source maps or chunk maps, trace bundle loading, recover hidden routes or APIs from emitted assets, or explain runtime behavior from built frontend artifacts.' This matches the score-3 anchor listing several concrete actions rather than a vague single domain.

3 / 3

Completeness

Explicitly answers what ('CTF-sandbox workflow for source maps, build manifests, chunk registries, emitted bundles, obfuscated loader flow, and frontend runtime recovery') and when ('Use when the user asks to reconstruct served JavaScript structure, inspect source maps...'), with an explicit 'Use when' clause, so it is not capped at 2.

3 / 3

Trigger Term Quality

Includes natural domain terms a CTF/sandbox user would actually say across several variations — 'source maps', 'chunk maps', 'bundle loading', 'hidden routes or APIs', 'runtime behavior', 'built frontend artifacts' — giving good coverage rather than a single generic keyword.

3 / 3

Distinctiveness Conflict Risk

Occupies a clear, narrow CTF built-frontend-artifact niche with explicit routing ('Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here'), making conflict with other skills unlikely.

3 / 3

Total

12

/

12

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
zhaoxuya520/reverse-skill
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.