CtrlK
BlogDocsLog inGet started
Tessl Logo

competition-bundle-sourcemap-recovery

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for source maps, build manifests, chunk registries, emitted bundles, obfuscated loader flow, and frontend runtime recovery. Use when the user asks to reconstruct served JavaScript structure, inspect source maps or chunk maps, trace bundle loading, recover hidden routes or APIs from emitted assets, or explain runtime behavior from built frontend artifacts. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.

68

Quality

82%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Low

Low-risk findings worth noting

SKILL.md
Quality
Evals
Security

Quality

Content

72%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is well-structured and appropriately concise for an instruction-only recovery skill, with clean progressive disclosure to a real reference file. The main weakness is workflow clarity: steps are sequenced but lack explicit validation checkpoints to prove the decisive runtime path.

Suggestions

Add an explicit validation/verification checkpoint in the Workflow (e.g., "Before concluding, prove the recovered route/API actually executes in the currently served bundle") to lift workflow_clarity above 3.

De-duplicate the served-artifact-set and decisive-bundle-path content between the Quick Start and Workflow sections to tighten conciseness.

Optionally surface one concrete executable check (e.g., a snippet or command to confirm a chunk id against the manifest) to move actionability from directional to copy-paste ready.

DimensionReasoningScore

Conciseness

Lean body that assumes Claude's competence — no preamble explaining what source maps or bundles are — but there is mild repetition between the Quick Start and Workflow sections (e.g., served artifact set, decisive bundle path restated).

4 / 5

Actionability

Concrete, specific procedural guidance ("Record chunk ids, route chunks, loader functions, endpoint strings, and config keys", "Follow bootstrap code, chunk loaders, module registry, string decoders, and lazy import boundaries"); as an instruction-only analysis skill the absence of executable code is acceptable, though the guidance stays directional rather than copy-paste ready.

4 / 5

Workflow Clarity

A clear numbered Quick Start (1–5) and a three-step Workflow provide good sequencing, but there are no explicit validation checkpoints or feedback loops to confirm which bundle path actually executes at runtime.

3 / 5

Progressive Disclosure

The body is a concise overview with a clearly signaled one-level-deep reference ("Load `references/bundle-sourcemap-recovery.md`"), and the referenced file exists and matches what is described; sections are well organized.

5 / 5

Total

16

/

20

Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is strong: it states concrete capabilities, gives explicit "Use when" trigger guidance, and scopes itself clearly as a downstream specialization. Its only minor gap is missing a few common synonyms for sourcemaps/bundlers.

DimensionReasoningScore

Specificity

Lists multiple concrete actions across the domain — "reconstruct served JavaScript structure", "inspect source maps or chunk maps", "trace bundle loading", "recover hidden routes or APIs from emitted assets", "explain runtime behavior from built frontend artifacts" — giving comprehensive coverage.

5 / 5

Completeness

Explicitly answers both what ("CTF-sandbox workflow for source maps, build manifests, chunk registries, emitted bundles, obfuscated loader flow, and frontend runtime recovery") and when ("Use when the user asks to reconstruct... inspect... trace... recover... or explain...") with concrete trigger phrases.

5 / 5

Trigger Term Quality

Good coverage of natural phrases users would say ("reconstruct served JavaScript structure", "trace bundle loading", "recover hidden routes or APIs"), but a few common synonyms/extensions like "webpack" or ".map files" are missing.

4 / 5

Distinctiveness Conflict Risk

Occupies a clear niche (built frontend asset / sourcemap recovery) with distinct triggers, and the "Use only after `$ctf-sandbox-orchestrator`" boundary guidance further reduces conflict risk.

5 / 5

Total

19

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
zhaoxuya520/reverse-skill
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.