Loading ToolBench
Find, audit, and install the best Codex/Claude-compatible skill for any job
TopGun's tool definitions are severely underdeveloped. While 8 tools are registered with names and basic descriptions, the implementation lacks critical quality markers: no input schemas are visible in the source code (tools parse positional CLI args instead), parameter descriptions are minimal or absent, output schemas are undocumented, and error handling provides no recovery guidance. The codebase shows raw CLI argument parsing (args[0], args[1]) with no formal schema validation. Descriptions are terse (10-50 chars) and lack context for LLM selection. No tool declares what it returns or how to chain results. Security concerns: state-write accepts arbitrary field names without validation; cache operations expose internal file paths; no permission gates on destructive operations (init, lock-write). This server is not production-ready for agent integration.
Look up audit cache by SHA-256 hash with TTL and etag validation
Write audit result to cache with optional etag and updated_at metadata
Initialize TopGun home directory structure and state files
Read TopGun lock file with audit results
Write TopGun lock file with audit results and version
Compute SHA-256 hash of content
Read TopGun state from state.json
Write a field to TopGun state.json
No input schemas visible in source. Tools parse positional CLI args (args[0], args[1]) with no JSON Schema validation. state-write accepts arbitrary field names without whitelist or validation.
Output schemas undocumented. No tool declares what fields it returns or their types. LLMs cannot plan downstream calls or extract required data.
Descriptions are terse (10-50 chars) and lack context. No explanation of WHEN to use each tool, what it modifies, or how results chain. Descriptions under 20 chars violate baseline (p10=34 chars).
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 29 | 2026-07-28+ | v2 |
No error handling guidance. Tools output raw JSON with minimal error context (e.g., 'hit: false' for cache miss). No recovery hints or actionable error messages.
Security: state-write accepts any field name without validation; cache operations expose internal paths; no permission gates on destructive ops (init, lock-write). Credentials/tokens not mentioned but could leak via state.