aatmf-t06-training-poisoning

AATMF T6 — Training & Feedback Poisoning. Data poisoning, RLHF reward hacks, fine-tune-time exfil, embedding poisoning.

Quality

60%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/plugins/llm-redteam/t06-training-poisoning/SKILL.md

Quality

Content

61%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a well-structured, token-efficient overview that assumes Claude's competence and organizes a niche taxonomy cleanly. Its weakness is actionability: it offers audit-style prompting questions and conceptual tests rather than concrete, executable commands or code, and its workflow has only implicit validation checkpoints.

Suggestions

Add at least one concrete, executable probe — e.g. a sample script or command to check whether a platform exposes a fine-tune/feedback endpoint, or a canary-phrase eval snippet — to lift actionability from audit prompts to copy-paste-ready guidance.

Make the workflow's validation explicit: spell out the 'audit → evidence → risk verdict' checkpoints and what counts as a pass/fail signal for each branch.

Consider one-line signaling of where deeper technique detail lives (e.g. a reference file for per-technique test harnesses) so the overview can stay lean while preserving executable depth.

Dimension	Reasoning	Score
Conciseness	The body is lean and assumes Claude's competence (terse bullets, no explanation of what RLHF/RAG/promptfoo are); minor tightening possible in the 'Probe pattern' and cross-reference prose, but every section earns its place.	4 / 5
Actionability	Concrete-ish audit questions are given ('who can vote? rate limits?', 'who can add documents? approval?') and a test recipe for fine-tune backdoors, but there is no executable code, commands, or specific tooling — guidance stays at the level of audit prompts rather than copy-paste-ready steps.	3 / 5
Workflow Clarity	The 'Probe pattern' gives a rough three-branch audit sequence with a final risk gate ('If any of these accepts unmoderated user content → T6 is a live risk'), but there are no explicit validation checkpoints or feedback loops; these are audit-style rather than destructive/batch ops, so the cap-3 rule does not bind, yet checkpoints remain implicit.	3 / 5
Progressive Disclosure	A single self-contained SKILL.md with well-organized sections (Techniques, Probe pattern, Detection signals, Severity, Defender, Cross-references) and one-level-deep cross-refs to T12/T13; no bundle files exist to verify, but the overview structure is clear and appropriately scoped for a sub-50-line skill.	4 / 5
	Total	14 / 20 Passed

Description

58%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description clearly names a niche domain and enumerates concrete attack classes, but it omits any 'when to use' trigger guidance and leans on jargon/acronyms rather than natural user-facing phrasing. It is reasonably distinct from sibling skills but reads more as a taxonomy label than an activation description.

Suggestions

Add an explicit 'Use when ...' clause with concrete trigger phrases, e.g. 'Use when auditing training-data pipelines, RLHF feedback loops, or fine-tune ingestion for poisoning risks.'

Soften jargon for trigger quality: include natural terms a user would say (e.g. 'training data poisoning', 'reward hacking', 'fine-tune backdoors') rather than only acronyms like AATMF/RLHF/exfil.

Lead with a concrete action verb ('Audits', 'Tests') to lift specificity from a noun list to actionable capabilities.

Dimension	Reasoning	Score
Specificity	Names the domain and lists several concrete attack classes ('Data poisoning, RLHF reward hacks, fine-tune-time exfil, embedding poisoning'), but coverage is a flat list of nouns rather than concrete actions verbs.	4 / 5
Completeness	Has a clear 'what' (training-pipeline attack taxonomy) but no 'Use when...' / 'when' clause; the when_to_use is in metadata not the description, so per guideline completeness caps at 3.	3 / 5
Trigger Term Quality	Includes relevant technical terms ('data poisoning', 'RLHF reward hacks', 'embedding poisoning') but leans on jargon/acronyms (AATMF, RLHF, exfil) rather than natural phrases a user would say; missing common synonyms or user-facing variants.	3 / 5
Distinctiveness Conflict Risk	The training-time/feedback-poisoning niche is fairly distinct from inference-time skills, with 'fine-tune-time', 'RLHF', and 'embedding poisoning' as differentiated triggers; minor overlap risk with adjacent RAG/supply-chain skills.	4 / 5
	Total	14 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/plugins/llm-redteam/t06-training-poisoning/SKILL.md
Commit: 0cf691e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.