scholar-evaluation – skill Bảo mật cho agent AI
Cung cấp đánh giá phát triển ưu tiên định tính, có thể truy vết bằng chứng đối với các công trình học thuật và kiểm tra các bộ tiêu chí đánh giá nghiên cứu rủi ro thấp, có thể kèm kiểm soát chất lượng cục bộ tùy chọn. Không bao giờ dùng để xếp hạng con người hoặc cho các quyết định có hệ quả.
Cài skill scholar-evaluation bằng một lệnh
Chọn công cụ bạn đang dùng, copy lệnh và dán vào terminal. Skill sẽ nằm trong thư mục skills của công cụ đó và sẵn sàng dùng ở phiên làm việc tiếp theo.
Claude Code
mkdir -p ~/.claude/skills && curl -fsSL https://skill.dn1nguoi.com/z/scholar-evaluation-417e0.tgz | tar xz -C ~/.claude/skills
Gọi trong Claude Code: /scholar-evaluation – rồi mô tả công việc bạn muốn làm.
Codex
mkdir -p ~/.codex/skills && curl -fsSL https://skill.dn1nguoi.com/z/scholar-evaluation-417e0.tgz | tar xz -C ~/.codex/skills
Gọi trong Codex: $scholar-evaluation – rồi mô tả công việc bạn muốn làm.
Hermes Agent
mkdir -p ~/.hermes/skills && curl -fsSL https://skill.dn1nguoi.com/z/scholar-evaluation-417e0.tgz | tar xz -C ~/.hermes/skills
Gọi trong Hermes Agent: /scholar-evaluation – rồi mô tả công việc bạn muốn làm.
DeepSeek
mkdir -p ~/.deepcode/skills && curl -fsSL https://skill.dn1nguoi.com/z/scholar-evaluation-417e0.tgz | tar xz -C ~/.deepcode/skills
Gọi trong DeepSeek: /scholar-evaluation – rồi mô tả công việc bạn muốn làm.
Nội dung SKILL.md
Nội dung SKILL.md gốc bằng tiếng Anh.
Scholar Evaluation
Purpose
Provide developmental, evidence-traceable feedback on a scholarly work:
paper, draft, protocol, literature synthesis, or research idea. Use
qualitative judgment first. Optional scores only describe how submitted
evidence maps to a predeclared bounded rubric.
This skill also audits whether a low-stakes assessment process documents its
construct, provenance, rater quality, uncertainty, traceability, sensitivity,
fairness, accessibility, privacy, and human governance.
Hard safety boundary
Never use this skill to automate, recommend, materially influence, or score:
- hiring, promotion, or tenure;
- admissions;
- grants or other funding;
- prizes, honors, or awards;
- discipline, dismissal, or sanctions; or
- any other high-impact personnel decision.
Never rank people. Never reduce a person to a composite score. Never infer
ability, character, integrity, protected traits, future performance, or worth.
A nominal human-in-the-loop does not remove this boundary.
If asked for a prohibited use, stop. Offer developmental comments on a
scholarly work or a process-only audit that does not process applications,
compare people, recommend an outcome, or advise a decision.
Do not issue publication-readiness, accept/reject, or “top-tier” judgments.
Read references/responsible_assessment.md before any organizational use.
ScholarEval status
The referenced ScholarEval project is an **experimental
literature-grounded research-idea evaluation framework**, not validated
psychometrics.
The verified primary record is Moussa et al., *ScholarEval: Research Idea
Evaluation Grounded in Literature*, arXiv:2510.16234v2, revised 2026-02-28.
It reports a retrieval-augmented soundness/contribution framework, a
117-idea four-discipline dataset, coverage experiments, and a user study.
Do not generalize those results to person assessment, consequential decisions,
all disciplines, or this skill's rubric. No peer-reviewed publication status
was verified during the dated review. See references/source_ledger.md.
Metric and prestige policy
Do not score or infer quality from:
- Journal Impact Factor or other journal measures;
- h-index, publication counts, or citation counts;
- altmetrics or attention;
- journal, conference, venue, institution, employer, or geographic prestige;
- author affiliation, reputation, network, or career path.
The rubric validator rejects common proxy-measure criteria.
If a qualified reviewer mentions an indicator descriptively outside the
scoring tools, record its exact purpose, source, coverage, field and time
effects, uncertainty, missingness, biases, gaming risk, and why it does not
directly measure quality. Never hide indicators inside an opaque composite.
Data boundary
Bundled scripts accept only strict local JSON/CSV containing pseudonymous IDs,
bounded ratings, statuses, uncertainty, and local references.
Do not put raw private applications, CVs, letters, reviewer identities,
contact details, protected attributes, or source-document text in inputs,
outputs, logs, examples, or prompts. Keep source content in the authorized
records system and use opaque local references.
Allowed classifications are:
syntheticpublic_scholarly_workdeidentified_low_stakes
No script searches the web, loads environment files, reads credentials, calls a
model, executes supplied text, deserializes executable objects, or launches a
process.
Use Bash only to invoke the documented local python3 commands.
Workflow
1. Confirm allowed use and authorization
Record:
- developmental purpose;
- unit of assessment:
scholarly_work; - work type, stage, discipline, language, and audience;
- authorized source location and data classification;
- accountable committee owner;
- conflicts and recusals;
- accessibility and accommodation process;
- appeal or correction route; and
- data purpose, access, retention, and deletion.
Stop on a prohibited decision context or unnecessary private data.
2. Define the construct before criteria
State:
- what quality or support is being examined;
- excluded constructs;
- intended interpretation;
- contexts where the interpretation does not travel;
- evidence requirements; and
- known limitations.
Start with values and disciplinary context, not available metrics.
3. Adapt and validate the rubric
Begin with assets/rubric_template.json, then obtain qualified disciplinary,
assessment-methods, stakeholder, accessibility, privacy, and fairness review.
The template deliberately records content validity as not_established.
Do not change that status without documented evidence for the exact intended
use.
Validate structure:
PYTHONDONTWRITEBYTECODE=1 python3 scripts/validate_rubric.py \
--rubric assets/rubric_template.jsonRead references/evaluation_framework.md for construct, anchor, validity, and
rater guidance.
4. Build traceable evidence records
Reviewers may read an authorized work outside the scripts. Record only stable
local locators and claim references in
assets/evidence_manifest_template.json.
For every criterion, distinguish:
- observed evidence from interpretation;
- supporting from contrary evidence;
- available from unavailable evidence;
missingfromnot_applicable; and- uncertainty from absence.
Failure to find prior work does not prove novelty. Freeze the exact work revision and evidence-access date before independent rating so raters assess the same material. For public papers, check publisher correction/retraction notices and [Crossmark](https://www.crossref.org/services/crossmark/) where available; record unresolved status rather than treating absence of a notice as verification. If the work changes materially, issue a new evaluation linked to the prior revision.
5. Rate independently
Use assets/evaluation_template.json. Each criterion must be:
ratedwith an anchor score, bounded uncertainty, evidence IDs, and a local
rationale reference;
missingwith null score/uncertainty and a rationale reference; ornot_applicablewith null score/uncertainty and a rationale reference.
A rated zero requires inspected evidence demonstrating lack of support; unavailable
evidence is missing. Do not encode missing or not-applicable as zero. Raters should train, calibrate,
disclose conflicts, rate independently, and document disagreement.
6. Run local quality checks
Bounded scoring, without labels or recommendation:
PYTHONDONTWRITEBYTECODE=1 python3 scripts/calculate_scores.py \
--rubric assets/rubric_template.json \
--evaluation assets/evaluation_template.jsonEvidence traceability:
PYTHONDONTWRITEBYTECODE=1 python3 scripts/check_traceability.py \
--rubric assets/rubric_template.json \
--evaluation assets/evaluation_template.json \
--evidence assets/evidence_manifest_template.jsonInter-rater agreement (one evaluation_id identifies one frozen work and round;
raters share that ID within the round):
PYTHONDONTWRITEBYTECODE=1 python3 scripts/summarize_agreement.py \
--rubric assets/rubric_template.json \
--ratings assets/ratings_template.csvWeight sensitivity requires two or more distinct scholarly-work evaluation
files:
PYTHONDONTWRITEBYTECODE=1 python3 scripts/weight_sensitivity.py \
--rubric assets/rubric_template.json \
--evaluation /tmp/work-a-evaluation.json \
--evaluation /tmp/work-b-evaluation.jsonProcess controls:
PYTHONDONTWRITEBYTECODE=1 python3 scripts/check_process.py \
--process assets/process_checklist_template.jsonThe checklist template is intentionally unconfirmed and fails closed.
Instructions and exact schemas are in references/local_tooling.md.
7. Synthesize qualitative findings
Lead with criterion-level evidence, not the composite. For each criterion:
1. cite evidence references;
2. state rated, missing, or not_applicable;
3. explain the anchor interpretation;
4. report score and uncertainty only if rated;
5. note disagreements and context;
6. identify strengths and limitations; and
7. offer non-prescriptive improvement options.
Generate an empty-reference scaffold if useful:
PYTHONDONTWRITEBYTECODE=1 python3 scripts/generate_report_scaffold.py \
--rubric assets/rubric_template.json \
--evaluation assets/evaluation_template.json \
--output /tmp/developmental-report-scaffold.jsonThe scaffold does not read source documents or draft findings.
8. Human review and release
Before releasing an organizational report, a qualified accountable human
committee must verify:
- construct and rubric provenance;
- content-validity evidence and limits;
- rater training, agreement, inter-rater reliability evidence, and drift;
- evidence traceability and source access;
- missingness, not-applicable rationales, and uncertainty;
- weight sensitivity and order instability;
- disciplinary and subgroup bias review;
- conflicts and r
… (nội dung đầy đủ có trong gói tải về)
Skill liên quan
- subdomain-takeover-hunt – Phát hiện và xác minh lỗ hổng chiếm quyền subdomain qua CNAME treo trỏ tới dịch vụ chưa…
- cyber-audit – Chạy kiểm tra phơi nhiễm chỉ đọc đối với các cảnh báo bảo mật và ghi báo cáo kiểm toán…
- signed-audit-trails-recipe – Hướng dẫn từng bước (cookbook) để thiết lập nhật ký kiểm toán có ký mật mã cho các lệnh…
- supply-chain-attack-recon – Trinh sát bên ngoài bề mặt tấn công chuỗi cung ứng phần mềm — ứng viên chiếm dụng…
- darkmoon-pentest – Khởi động, theo dõi và phân loại các phiên pentest AI tự động đã được ủy quyền trên…
- dast-scanning – Thực hiện kiểm thử bảo mật ứng dụng động (DAST) với OWASP ZAP, Burp Suite và Nikto.
- tls-fingerprint-impersonation – Giả mạo dấu vân tay TLS ClientHello và JA4 để mô phỏng trình duyệt.
- database-security – Đánh giá bảo mật cơ sở dữ liệu được ủy quyền trên PostgreSQL, MySQL, MSSQL, MongoDB và…