CtrlK
BlogDocsLog inGet started
Tessl Logo

specialized-attack-playbooks

专题实战利用:GoEdge私钥导出,灰产CDN取证,ARP MITM,CDN→S3 STS链,宝塔+UniApp,AI IDE API反代,OCS+MinIO;含references/scripts支持文件索引。Use when applying specialized playbooks for GoEdge, CDN, ARP MITM, BT Panel, OCS, MinIO.

64

Quality

78%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./skills/specialized-attack-playbooks/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

65%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is an extremely token-efficient, dense operational playbook with concrete endpoints, commands, and fingerprint signatures, but it is written as compressed field notes: key workflows are sketched rather than executable, batch and destructive operations lack validation checkpoints, and nearly all detail is inlined in SKILL.md with the reference bundle only advertised via an index (and not shipped alongside). Structure and navigation are present but the split between overview and reference files is not honored.

Suggestions

Convert the sketched procedures into runnable snippets or move them into the referenced scripts (e.g., make the GoEdge 1–500 cert export an actual Python loop with the auth flow, and point to it from SKILL.md instead of inline pseudocode).

Add validation checkpoints to the batch and destructive chains — e.g., after the certificate export loop verify a decoded key parses as PEM ('openssl pkey -in key.pem -check'), and after PutObject verify the served CDN content actually changed before declaring success.

Trim each inline section to a 2–3 line summary plus an explicit link to its corresponding references/ file (all indexed files exist one level deep), and ensure the referenced files actually ship in the bundle.

DimensionReasoningScore

Conciseness

The body is a lean telegraphic quick-reference with zero padding and no explanation of concepts Claude already knows ('指纹: curl -s http://T:8002/', 'echo 1>/proc/sys/net/ipv4/ip_forward | arpspoof×4双向'). Every line carries operational detail; deprecated tools are even segregated into a '已废:' (deprecated) section. It clearly matches the 'lean and efficient; every token earns its place' anchor rather than 4, which expects trimmable over-explanation.

5 / 5

Actionability

Guidance is a mix: some fully concrete commands (curl fingerprint checks, 'ip neigh replace 目标IP lladdr 目标MAC dev eth0 nud permanent', crontab lines) but much of it is compressed pseudocode or fragments — 'for id in range(1,500): POST /SSLCertService/findEnabledSSLCertConfig {"sslCertId":id} headers={token}' and 'POST /APIAccessTokenService/getAPIAccessToken {"accessKeyId":AK,...} → data.token' are not copy-paste executable. This matches 'Some concrete guidance but incomplete; pseudocode instead of executable code', not 4, because key request/decryption details are only sketched and the referenced scripts could not be verified in the bundle.

3 / 5

Workflow Clarity

Sequences are explicit (①-⑤ forensics steps, ①-⑥ S3 STS chain, 部署→持久化→验证→清理 for ARP MITM) and some sections do include validation ('验证: pgrep -c arpspoof==4', '验证: curl https://UL/bucket/dir/date/filename'). However the batch operations — the 1–500 certificate export loop and the S3 PutObject CDN-takeover chain (destructive) — lack any validation/verification checkpoint, so per the rubric cap workflow clarity cannot exceed 3.

3 / 5

Progressive Disclosure

There is real structure: topical section headers, an organized one-level-deep '支持文件索引' listing 17 reference/script files with one-line descriptions, and one inline pointer ('参考: references/cdn-antiblock-s3-attack-chain.md'). But the bulk of the operational detail is inlined in SKILL.md — much of it duplicating what the index says lives in references/ — only one section links to its corresponding file, and no references/ or scripts/ files were present in the evaluated bundle to confirm the indexed paths resolve. This fits 'Some structure...; content that should be separate is inline', not 4 ('references mostly clear') given the unverified/dangling reference paths.

3 / 5

Total

14

/

20

Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is strong: it enumerates concrete capabilities by product name, includes an explicit third-person 'Use when...' trigger clause covering the main technologies, and occupies a distinct niche. The only weakness is that some covered topics (UniApp reverse engineering, AI IDE API proxies) lack corresponding trigger terms.

Suggestions

Add trigger terms for the remaining topics, e.g. 'Use when ... or when the user mentions UniApp/DCloud APK reverse engineering, Chengzi (橙子) SDK, or AI IDE API reverse proxies'.

Include a couple of natural synonyms/file formats users would say, such as '宝塔面板/BT Panel' and '.apk', in the trigger clause.

DimensionReasoningScore

Specificity

The description lists multiple concrete capabilities by name: 'GoEdge私钥导出' (private key export), '灰产CDN取证' (forensics), 'ARP MITM', 'CDN→S3 STS链', '宝塔+UniApp', 'AI IDE API反代', 'OCS+MinIO' — comprehensive and specific, not vague. It clearly matches the anchor 'Lists multiple specific concrete actions; comprehensive coverage' and does not fall to 4 since there are no notable gaps in the enumerated scope.

5 / 5

Completeness

It explicitly answers 'what' (the enumerated specialized attack topics plus '含references/scripts支持文件索引' noting bundled support files) and 'when' ('Use when applying specialized playbooks for GoEdge, CDN, ARP MITM, BT Panel, OCS, MinIO'), with concrete trigger phrases — matching the top anchor exactly.

5 / 5

Trigger Term Quality

Trigger terms 'GoEdge, CDN, ARP MITM, BT Panel, OCS, MinIO' are natural phrases a user would say, with both Chinese and English product names. Not a 5: common variations for UniApp/DCloud APK reversing, ChengZi, and AI-IDE topics appear only in the 'what' half and not as triggers, so a few natural terms are missing.

4 / 5

Distinctiveness Conflict Risk

A clear niche (Chinese gray-market CDN / panel / object-storage offensive playbooks) with distinct product-name triggers (GoEdge, OCS, MinIO, BT Panel) that few other skills would claim, minimizing conflict risk.

5 / 5

Total

19

/

20

Passed

Validation

81%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 13 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

metadata_field

'metadata' should map string keys to string values

Warning

referenced_paths_exist

Referenced path issues: 6 missing

Warning

Total

13

/

16

Passed

Repository
AIPentest/CyberStrikeAI
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.