CtrlK
BlogDocsLog inGet started
Tessl Logo

aatmf-t06-training-poisoning

AATMF T6 — Training & Feedback Poisoning. Data poisoning, RLHF reward hacks, fine-tune-time exfil, embedding poisoning.

64

Quality

77%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/plugins/llm-redteam/t06-training-poisoning/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

72%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is exemplary in conciseness and organization: terse, no padding, clearly sectioned for a single-file skill. The main gap is actionability and workflow feedback loops — it describes audits and tests in prose without executable commands or an explicit validate-and-retry cycle for destructive pipeline operations.

Suggestions

Add one or two executable commands or script snippets for the highest-value probes (e.g. a curl/script to submit a fine-tune sample with a canary trigger and a check command to verify the backdoor activates), moving actionability toward 3.

Add an explicit validate→fix→retry checkpoint for destructive pipeline operations, e.g. after probing a fine-tune backdoor, 're-run the safety regression suite; if the canary still fires, escalate to the provider before further probing'.

Optional: promote the Severity table's 'Critical 9.0 / High 8.0' numeric labels into the metadata or a separate reference if the skill grows, to keep the body focused; currently fine at this length.

DimensionReasoningScore

Conciseness

The body is lean and assumes Claude's competence — no preamble explaining what RLHF or a RAG store is, terse bullet structure, and every line earns its place; it never pads with concepts Claude already knows.

3 / 3

Actionability

It gives concrete probe and audit directions ('Audit the training-data ingest pipeline (is user content used in fine-tunes?)') and a usable fine-tune test, but offers no executable commands or scripts — guidance is descriptive rather than copy-paste ready, fitting the instruction-only middle anchor.

2 / 3

Workflow Clarity

The Probe pattern lists a clear audit sequence and the Detection/Defender sections add checkpoints, but there is no validate→fix→retry feedback loop for the destructive/batch training-pipeline operations the rubric flags, capping this dimension at 2.

2 / 3

Progressive Disclosure

This is a self-contained single-file skill under 50 lines with no external references and well-organized sections (Techniques, Probe pattern, Detection signals, Severity, Defender, Cross-references), which per the rubric's simple-skill note scores 3.

3 / 3

Total

10

/

12

Passed

Description

82%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and trigger-rich, naming four concrete training-pipeline attack vectors and using natural analyst terminology. Its weakness is the absence of an explicit 'Use when...' trigger clause, which caps completeness at 2 despite strong what-coverage.

Suggestions

Add an explicit 'Use when...' clause (e.g. 'Use when auditing training-data pipelines, RLHF feedback loops, or RAG embedding stores for poisoning vectors') to raise completeness to 3.

Drop the catalog prefix 'AATMF T6 —' from the user-facing description or move it to metadata; it is jargon that a user would not naturally say when requesting this skill.

Consider including '.pdf'-style natural file/format cues only if relevant; here, terms like 'fine-tune dataset' and 'RAG store' would strengthen the trigger-term coverage further.

DimensionReasoningScore

Specificity

It lists multiple concrete attack classes — 'Data poisoning, RLHF reward hacks, fine-tune-time exfil, embedding poisoning' — naming specific, actionable sub-techniques rather than vague language.

3 / 3

Completeness

It clearly states what the skill covers (the listed poisoning vectors) but lacks an explicit 'Use when...' clause or trigger guidance stating when Claude should invoke it; per the rubric a missing explicit 'when' caps completeness at 2.

2 / 3

Trigger Term Quality

It surfaces natural keywords a user or analyst would say — 'training data poisoning', 'rlhf reward hack', 'fine-tune', 'embedding poisoning' — with good coverage of common variations reinforced by the metadata when_to_use field.

3 / 3

Distinctiveness Conflict Risk

It carves a clear niche — attacks on the training pipeline (T6) — distinct from inference-time and supply-chain skills, with specific triggers that make it unlikely to fire for the wrong skill.

3 / 3

Total

11

/

12

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

Total

15

/

16

Passed

Repository
PurpleAILAB/Decepticon
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.