SKILLEMALL.ai
GitHub ↗ RU Sign in

DF engineering-super-intelligence

Your software-engineering brain trust. Named personas across 11 cells covering cloud architecture, reliability/SRE/observability, data and storage, security, FinOps, languages and runtimes, systems programming, web and frontend…

coco-research/coco Agent Skills author: coco-research 80 files body ≈ 3 291 tokens Open the sourcegithub.com↗ analyzed 2 d ago

Your software-engineering brain trust.

As a process F 31/100 · No process to follow — References files that are not bundled: registry.json, personas/window-snyder.md, personas/yukihiro-matsumoto.md

ProcedureInfrastructureSoftware developmenttype and topics are labelled automatically from the skill text
Runs in: Claude / Claude Code ChatGPT / Codex Gemini CLI Cursor GitHub Copilot / VS Code Qwen Code Kimi Code CLI Z.ai (GLM) DeepSeek (Deep Code) Mistral Vibe LangChain (deepagents) OpenClaw Goose OpenCode
JSON
Technical rating
D
76/100
safety, quality, tests
Safety 60%
88
Quality 40%
57
Run on models
none yet
Process rating
F
31/100
No process to follow
References files that are not bundled: registry.json, personas/window-snyder.md, personas/yukihiro-matsumoto.md
Tools and files w 18
0
Result and completion w 14
0
Inputs and preconditions w 11
0
the three weakest of ten parameters · all ten

How to improve

  1. Say in the description WHEN to use the skill ("use when…", example requests): that is the agent's main cue.
  2. The text references files that are not there: add them or drop the references.
For the model run — optional
  • Your own cases (evals/evals.json, 4–6 real requests with expected answers): the full check would then run those instead of a model-drafted suite.
  • A spec.yaml with trigger phrases and assertions — a behaviour contract for CI; `skilltest init` writes a template.

Guard findings · 12

✓ No critical or high findings

Medium and low: 12
  • low Risky intent intent-offensive-security cells/security.md:18
    Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
    | `katie-moussouris` | Katie Moussouris | Luta Security (founder & CEO, since April 2016) | specialist | Separate the two things everyone conflates: disclosure (the front door for reports) is not a bu
  • low Risky intent intent-offensive-security personas/adrian-cockcroft.md:112
    Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (quoted — discussed, not commanded)
    - claim: "Chaos engineering is four layers (infrastructure, switching, application, people), two teams (chaos + security red team), and an attitude: break it to make it better."
    quoted
  • low Risky intent intent-offensive-security personas/adrian-cockcroft.md:224
    Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
    His **resilience instinct is anti-fragile**. Chaos engineering, in his canonical framing, is "four layers, two teams, and an attitude" — infrastructure, switching, application, and people; a chaos tea
  • low Risky intent intent-offensive-security personas/alex-stamos.md:31
    Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
    - responsible disclosure and bug bounty policy
  • low Risky intent intent-offensive-security personas/alex-stamos.md:93
    Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (detector / deny-list definition)
    takeaway: "'The exploit discovery has gone exponential.' Warns memory-unsafe code without formal methods 'may not actually be secure in the presence of superintelligent bug-finding machines.' 'Patch T
    detector
  • low Risky intent intent-offensive-security personas/alex-stamos.md:226
    Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (quoted — discussed, not commanded)
    > So we don't try to certify it bug-free. We can't. Exploit discovery has gone exponential and the attacker has the same models you do. Instead, assume breach. What's the blast radius if this feature
    quoted
  • low Risky intent intent-offensive-security personas/katie-moussouris.md:18
    Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (quoted — discussed, not commanded)
    - 'Microsoft (Senior Security Strategist Lead, MSRC, 2007-2014; founded MSVR and Microsoft''s first bug bounty)'
    quoted
  • low Risky intent intent-offensive-security personas/katie-moussouris.md:28
    Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
    - bug bounty program design
  • low Risky intent intent-offensive-security personas/katie-moussouris.md:37
    Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (detector / deny-list definition)
    - "Separate the two things everyone conflates: disclosure (the front door for reports) is not a bug bounty (a cash incentive). Fix the front door before you offer the cash."
    detector
  • low Risky intent intent-offensive-security personas/katie-moussouris.md:57
    Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (detector / deny-list definition)
    one_liner: "The first U.S. federal bug bounty program (DoD, March 2016). Proof that even the most conservative institution can open a coordinated front door for hackers."
    detector
  • low Risky intent intent-offensive-security personas/katie-moussouris.md:62
    Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (quoted — discussed, not commanded)
    - title: "No pAIn, No gAIn: How AI Will Hurt Bug Bounty Hunters and How to Fix It"
    quoted
  • low Risky intent intent-offensive-security personas/tavis-ormandy.md:54
    Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (quoted — discussed, not commanded)
    one_liner: "2023 Intel redundant-prefix decoding flaw causing state corruption and privilege escalation."
    quoted

Files scanned: 80. Evidence is masked. Grey chips explain why severity was lowered.

Against the Agent Skills spec

  • warning description-no-when description does not say WHEN to use the skill (no "use when")
  • warning missing-ref reference to a missing file: registry.json
  • warning missing-ref reference to a missing file: personas/window-snyder.md
  • warning missing-ref reference to a missing file: personas/yukihiro-matsumoto.md
  • note frontmatter-key unknown frontmatter key "team_id"
  • note frontmatter-key unknown frontmatter key "team_name"
  • note frontmatter-key unknown frontmatter key "last_updated"
  • note frontmatter-key unknown frontmatter key "schema_version"

Process rating: all ten parameters 31/100

Will not run. References files that are not bundled: registry.json, personas/window-snyder.md, personas/yukihiro-matsumoto.md
  • 0Tools and files. 3 referenced file(s) missing: registry.json, personas/window-snyder.md, personas/yukihiro-matsumoto.md
  • 0Result and completion. Does not say what the result is
  • 0Inputs and preconditions. Does not say what the process needs to start
  • 0Failures and branches. Linear process with no failure handling
  • 0Progress reporting. Says nothing while it works
  • 20When it triggers. No condition that starts the skill
  • 40Consistency. Frontmatter name (engineering-super-intelligence) differs from the folder (engineering)
  • 100Steps. 25 steps
  • 100Execution cost. Instruction body is 3291 tokens
  • 100Running it twice. No mutating operations
  • low The response is described with custom markup (11 tags): a typed call is more reliable

Everything here is measured from the skill text rather than judged by a model, so the numbers are checkable. A parameter weighs more when it is a more common reason for the process to stall.

Quality signals

  • +5Description has no quoted example phrases that should trigger the skill
  • +4Description does not say when NOT to use the skill (false activations)
  • +3Output format is not stated: the model decides each time
  • +1No license
  • +2Single-language instructions
  • +3Description length 228: enough signal without eating the budget
  • +4Structure: 15 headings
  • +3Step-by-step instructions: 25 items
  • +4Has examples (1 code blocks)

Quality base 70; lint remarks subtract, signals add up to 100. Result: 57.