CtrlK
BlogDocsLog inGet started
Tessl Logo

competition-graphql-rpc-drift

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for GraphQL schemas, persisted queries, RPC manifests, generated clients, OpenAPI drift, hidden operations, and contract-to-handler mismatches. Use when the user asks to inspect GraphQL or RPC requests, compare client contracts to live handlers, recover hidden operations, trace generated clients, or explain how schema or contract drift produces the decisive behavior. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.

66

Quality

78%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

High

Do not use without reviewing

Fix and improve this skill with Tessl

tessl review fix ./CTF-Sandbox-Orchestrator/competition-graphql-rpc-drift/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

57%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-organized instruction-only overview that correctly offloads detail to one clearly signaled, real reference, but the Quick Start and Workflow sections duplicate the same three-phase flow and the guidance stays abstract without concrete examples or an explicit validation loop. Conciseness, actionability, and workflow clarity each have clear room to reach the top anchor.

Suggestions

Collapse the Quick Start steps and Workflow sections 1–3 into a single Map→Prove→Reduce sequence; they currently restate the same flow and duplicate tokens.

Add one concrete example pair (one accepted operation, one drifted/hidden operation) showing the exact request shape and the handler branch it hits, so the guidance is copy-paste actionable rather than abstract procedure.

Insert an explicit validate→fix→re-run checkpoint after step 5 (e.g., confirm the reproduced mismatch hits the decisive branch before declaring done) to close the feedback loop for a mutation-adjacent workflow.

DimensionReasoningScore

Conciseness

It assumes Claude's intelligence (no explanation of what GraphQL/RPC is) and is generally lean, but the Quick Start steps and Workflow sections 1–3 restate the same Map→Prove→Reduce flow, so not every token earns its place. Not a 3 because that Quick Start/Workflow duplication is clear tightening opportunity; not a 1 because it avoids concept padding and stays domain-focused.

2 / 3

Actionability

Guidance names concrete artifacts and fields to capture ('operation name, variables, method, path, and auth context', 'persisted query map, or OpenAPI spec'), but it is procedural rather than executable — no commands, tools, or a worked example pair. Not a 3 because, even allowing instruction-only skills, it lacks a concrete copy-paste example; not a 1 because the capture lists are specific and actionable, not vague.

2 / 3

Workflow Clarity

A clear sequence exists (Quick Start 1–5, Workflow 1–3) with a 'prove the decisive branch' verification and a 'before mutating anything' guard, but there is no explicit validate→fix→retry checkpoint. Not a 3 because the mutation-adjacent workflow lacks an explicit feedback loop (capping per the destructive/batch guideline); not a 1 because the sequence is unambiguous and a verification concept is present.

2 / 3

Progressive Disclosure

The body is a concise overview that pushes checklists to a single, clearly signaled, one-level-deep reference ('Load references/graphql-rpc-drift.md for the contract checklist, live-handler checklist, and evidence packaging'), and that file exists with no further nesting. Not a 2 because the split is appropriate and navigation is explicit, not merely present.

3 / 3

Total

9

/

12

Passed

Description

100%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A tightly scoped, third-person description that names concrete capabilities, provides explicit 'Use when' triggers covering natural phrasings, and clearly distinguishes itself as a downstream specialization of ctf-sandbox-orchestrator. It fully satisfies the what/when and distinctiveness requirements with no over-claims or padding.

DimensionReasoningScore

Specificity

Lists multiple concrete actions ('inspect GraphQL or RPC requests, compare client contracts to live handlers, recover hidden operations, trace generated clients') plus a specific surface ('GraphQL schemas, persisted queries, RPC manifests, generated clients, OpenAPI drift'). It is not a 2 because the action set is comprehensive and concrete, not merely naming a domain.

3 / 3

Completeness

Explicitly answers what ('CTF-sandbox workflow for GraphQL schemas, persisted queries, RPC manifests...') and when ('Use when the user asks to...'), satisfying the explicit 'Use when...' trigger requirement. Not a 2 because the when-clause is explicit and substantive, not merely implied.

3 / 3

Trigger Term Quality

The 'Use when the user asks to inspect... compare... recover hidden operations... trace generated clients... explain how schema or contract drift produces the decisive behavior' phrasings map to what a user would naturally say in this CTF context. Good coverage of natural trigger terms; not a 2 because common variations are well represented rather than partially covered.

3 / 3

Distinctiveness Conflict Risk

Scoped to a narrow niche (GraphQL/RPC contract drift) and gated as downstream of `$ctf-sandbox-orchestrator` ('Use only after... has already established sandbox assumptions and routed here'), making misrouting unlikely. Not a 2 because the gate plus domain-specific triggers give it a clear, non-overlapping niche.

3 / 3

Total

12

/

12

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
zhaoxuya520/reverse-skill
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.