CtrlK
BlogDocsLog inGet started
Tessl Logo

testland/crash-triage-reference

Reference catalog for triaging fuzzer crash artifacts - reading ASan, UBSan, and MSan output; classifying findings as LIKELY-EXPLOITABLE, MEDIUM, or BENIGN; deduplicating by stack-hash; minimizing reproducers with -minimize_crash; plus the bulk triage workflow for a full artifact directory (inventory, reproduce, classify, dedupe, BLOCK/PASS verdict with refuse-to-proceed rules and a report template). Use when you need to understand what a specific crash means, build exploitability intuition, work a set of findings by hand, or run a campaign-level triage that ends in a release verdict.

70

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

Overview
Quality
Evals
Security
Files

Quality

Content

81%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured reference catalog with executable commands, a strong validated bulk-triage workflow, and clear external references. The main trim opportunities are the repeated inline documentation URLs and slightly vaguer AFL++ guidance.

Suggestions

Consolidate the clang/libFuzzer documentation URLs into the References section only, removing the repeated inline '(per clang.llvm.org/docs/...)' citations that pad each section.

Add a concrete afl-tmin command example and a one-line symbolization command for AFL++ artifacts so the AFL++ path is as actionable as the libFuzzer one.

Consider moving the per-sanitizer output-reading details or the full exploitability table into reference files under references/ to reduce SKILL.md to a tighter overview that points one level deep.

DimensionReasoningScore

Conciseness

The body is mostly lean and assumes programming competence, but each clang documentation URL is repeated inline several times per section (e.g. the AddressSanitizer URL appears ~4 times in the body) in addition to the consolidated References list - those repeated inline links could be trimmed.

4 / 5

Actionability

Concrete, copy-paste-ready bash is provided for stack-hash dedup, -minimize_crash, re-running with -runs=1, and inventory listing, plus a report template and classification table; the minor gap is the AFL++ path, where 'use afl-tmin' and 'symbolization separately' are described rather than commanded.

4 / 5

Workflow Clarity

The Bulk triage workflow is a clearly sequenced six-step process (Inventory, Reproduce, Classify, Deduplicate, Flag, Verdict) with explicit validation checkpoints - the refuse-to-proceed rules and 'never classify from memory / re-run against the binary' guards act as a checklist with feedback loops for this batch operation.

5 / 5

Progressive Disclosure

No bundle files are present, so this is scored on the single-file structure: sections are well-organized with clear headers and external LLVM links are consolidated into a one-level-deep References section at the end. Some content (per-sanitizer details, the full classification table) could plausibly live in separate reference files, which keeps it just short of a 5.

4 / 5

Total

17

/

20

Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that clearly states both what the skill does and when to invoke it, with a concrete trigger clause and a distinct niche. The only mild gap is keyword breadth - a few natural synonyms and file-extension triggers are missing.

DimensionReasoningScore

Specificity

The description lists multiple concrete actions - 'reading ASan, UBSan, and MSan output; classifying findings as LIKELY-EXPLOITABLE, MEDIUM, or BENIGN; deduplicating by stack-hash; minimizing reproducers with -minimize_crash; plus the bulk triage workflow' - giving comprehensive coverage of the skill's capabilities.

5 / 5

Completeness

It explicitly answers 'what' (reference catalog with the enumerated triage actions) and 'when' via a concrete 'Use when you need to understand what a specific crash means, build exploitability intuition, work a set of findings by hand, or run a campaign-level triage that ends in a release verdict' clause.

5 / 5

Trigger Term Quality

Natural domain terms like 'triaging fuzzer crash artifacts', 'exploitability intuition', 'work a set of findings by hand', and 'campaign-level triage' are present, but it lacks some synonyms and file-extension variants (e.g. 'crash-*' prefixes, '.asan') that would round out the keyword set.

4 / 5

Distinctiveness Conflict Risk

The niche - post-hoc triage of clang-sanitiser fuzzer crash artifacts ending in a release verdict - is highly specific with distinct triggers (ASan/UBSan/MSan, stack-hash, BLOCK/PASS), giving minimal overlap with the sibling coverage-guided-fuzzing skill which is about running campaigns rather than triaging their output.

5 / 5

Total

19

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

referenced_paths_exist

Referenced path issues: 4 missing

Warning

Total

15

/

16

Passed

Reviewed

Table of Contents