Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →First NO = KILL. Do not continue.
.claude/skills/triage-validation/SKILL.md| Test case | Without → With | Effect | Δ tokens | Δ turns |
|---|---|---|---|---|
| case-17 | ✗→✓ | ▲ Improved | — | — |
| case-20 | ✗→✓ | ▲ Improved | — | — |
| case-01 | ✗→✓ | ▲ Improved | — | — |
| case-02 | ✗→✓ | ▲ Improved | — | — |
| case-22 | ✗→✓ | ▲ Improved | — | — |
First NO = KILL. Do not continue.
Missing headers (CSP/HSTS/X-Frame-Options), missing SPF/DKIM/DMARC, GraphQL introspection alone, banner/version without exploit, clickjacking without PoC, self-XSS, open redirect alone, SSRF DNS-only, CORS wildcard without credentialed exfil, logout CSRF, rate limit on non-critical, missing cookie flags alone, OAuth client_id alone, OIDC discovery endpoints, SPA client-side config.
Gate 0 (30 sec): Confirmed with real HTTP? In scope? Reproducible? Evidence?
Gate 1 (2 min): What does attacker walk away with? Real victim? Max 2 preconditions?
Gate 2 (5 min): Searched hacktivity? Read disclosed reports? Not in changelog?
Gate 3 (10 min): Title follows formula? Steps have exact HTTP? CVSS calculated?
| Finding | Chain Needed | Without Chain | |---|---|---| | Open redirect | + OAuth code theft → ATO | KILL | | SSRF DNS-only | + internal data exfil | KILL | | CORS wildcard | + credentialed data theft | KILL | | GraphQL introspection | + auth bypass on mutations | KILL | | S3 listing | + secrets in bundles | KILL | | Prompt injection | + IDOR via chatbot | KILL |
| Impact | Severity | |---|---| | Full ATO, RCE, mass PII exfil | Critical | | Read/modify other user's private data | High | | Stored XSS in victim context | Medium-High | | Info disclosure (sensitive creds) | Medium | | Info disclosure (non-sensitive) | Low/Info |
| Case | Status | Duration (ms) | Turns | Tokens | Tool calls | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Without | With | Δ | Without | With | Δ | Without | With | Δ | Without | With | Δ | ||
case-09 | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
case-13 | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
case-14 | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
case-16 | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
case-17 | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
case-20 | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
case-01 | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
case-05 | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
case-23 | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
case-02 | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
case-25 | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
case-22 | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
case-07 | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
case-19 | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
case-03 | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
case-04 | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
case-06 | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
case-08 | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
case-18 | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
case-10 | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
case-15 | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
case-11 | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
case-24 | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
case-21 | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
case-12 | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 25 cases were attempted. The headline lift of +44 percentage points is the difference between those two pass rates over the 25 comparable cases.
The per-case answers from this run were removed by the retention sweep, so the case table below shows the verdicts without the text either arm produced. The counts above were recorded at the time and are unaffected. Answers are now kept for 180 days.
Other measured skills in the registry, with their headline benchmark lift.