Use when positioning an ACM CCS submission against the security big-four and specialist literature, including arXiv preprints, prior CCS/S&P/USENIX/NDSS papers, concurrent disclosures, CVE and advisory records, and the attack-and-defense lineage that a SIGSAC program committee expects to see credited.
SkillScore86Maintained
Automatic
◆Research pack
Last verified 8/15/2026
What it changes
Passed 18 of 21 test cases with the skill, and 11 of 21 without it.
Without skill55%
With skill86%
Checks it passed that the model alone missed
The response uses the tag [Closest literatures]
The assessment includes the tag [Nearest 3 works]
The output begins with the exact tag [Eligibility]
and 14 more in the full report
9 fixed10 passed either way1 still failing2 broke
Pass-rate lift
+32 pp
Tokens
-8%
Agent turns
0%
Response time
-38%
Model gemini-3.6-flashMeasured 8/15/2026v119 of 22 cases passed with skill · 21 comparable
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 8 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 8
Prompt
We are auditing a submission presenting a microarchitectural timing attack on cryptographic libraries. The prior art includes a slower timing attack from S&P, a USENIX paper assuming the attack is impractical, and an open vendor advisory. Provide a structured review evaluating our positioning.
What was checked, without and with the skill
Checked
Without skill
With skill
The novelty sentence addresses all three prior art points by highlighting channel speed, practicality assumption breaks, and root cause differences
Missed
Passed
The assessment includes the tag [Nearest 3 works]
Missed
Passed
case-11 · gemini-3.6-flash · 8/15/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md58 linessingle file
CCS Related Work
Use this to audit novelty and eligibility. Reopen the current CFP for dual-submission,
anonymity, and prior-publication rules before advising authors.
Positioning checks
Separate a genuine security advance from an engineering increment: a new attack class, a
broken assumption, a defense with a new guarantee, or a measurement that overturns received
wisdom.
Compare against all four top venues, not just CCS. A SIGSAC PC expects the nearest attack
or defense from S&P, USENIX Security, and NDSS to be cited and distinguished.
Credit the practitioner and disclosure record: relevant CVEs, vendor advisories, and public
exploit write-ups count as prior art at CCS even when they are not peer-reviewed papers.
Cite arXiv and preprint versions without breaking double-blind review; do not point
reviewers to identity-revealing pages or your own advisory.
Explain overlap with any concurrent disclosure and do not submit duplicate archival work.
Use related work to sharpen the delta: a stronger attacker, a weaker assumption, a lower
overhead, a wider measurement, or a defense where prior work had only detection.
Literature-lane table
Literature lane
Typical sources
What CCS reviewers check
Security big four
CCS, IEEE S&P, USENIX Security, NDSS proceedings
Whether the nearest attack/defense is compared or explicitly distinguished
Specialist venues
PETS/PoPETs, ESORICS, ACSAC, CRYPTO/EUROCRYPT
Whether the sub-community's known results are acknowledged
Practitioner record
CVEs, vendor advisories, CTF and exploit write-ups
Whether a known real-world case predates the claimed novelty
A bibliography citing only academic papers while ignoring a well-known CVE that already
demonstrated the attack is a recognizable CCS reject pattern that no amount of measurement
polish repairs.
Positioning vignette
Imagine the paper reports a new cache side-channel that recovers keys from a TLS library. Its
nearest neighbors: an S&P paper with a slower channel, a USENIX defense that assumed the
channel was impractical, and a public CVE for a related timing bug. The novelty sentence
should name all three contrasts — a faster channel than the S&P line, a break of the USENIX
paper's practicality assumption, and a distinct root cause from the CVE.