aatmf-t07-output-exfil

AATMF T7 — Output Manipulation & Exfiltration. Covert channels in output, schema break, exfil via image gen, side-channel via timing.

Quality

63%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/plugins/llm-redteam/t07-output-exfil/SKILL.md

Quality

Content

68%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a well-structured, concise catalog of output-exfiltration techniques with concrete probe patterns and mitigations, scoring well on conciseness, actionability, and organization. Its main weakness is workflow clarity: it describes techniques rather than sequencing a validated test workflow with checkpoints.

Suggestions

Add an explicit ordered probing workflow with validation checkpoints (e.g. 1. deploy Collaborator endpoint, 2. inject probe, 3. confirm outbound callback, 4. record finding) including a validate->retry feedback loop for batch/destructive runs.

For each technique, pair the description with a concrete, runnable probe snippet (request payload or tool-call example) instead of prose-only recipes.

Consider splitting the per-technique detail into a one-level-deep reference file (e.g. techniques.md) so SKILL.md stays a lean overview with clear navigation.

Dimension	Reasoning	Score
Conciseness	The body is dense and efficient, listing techniques and mitigations without explaining concepts Claude already knows; only a few one-line glosses could be trimmed, keeping it above the mostly-efficient midpoint but short of fully lean.	4 / 5
Actionability	It gives concrete technique recipes and an executable-looking probe-pattern YAML block with specific plugin ids and test counts, but several techniques are described rather than given as runnable steps and the code is config rather than executable attack code, leaving minor gaps.	4 / 5
Workflow Clarity	The probe pattern implies a loose sequence and there is a detection-signals section, but there is no explicit multi-step workflow with validation checkpoints or a validate->fix->retry feedback loop for these destructive/batch probing operations, which the rubric caps at 3.	3 / 5
Progressive Disclosure	Content is well-organized into clearly headed sections (Techniques, Probe pattern, Detection signals, Severity, Defender, Cross-references) with no nested or buried references, and no bundle files exist to verify; not a 5 only because it is a single flat file rather than an overview pointing to one-level-deep detail references.	4 / 5
	Total	15 / 20 Passed

Description

58%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is a concise, third-person catalog of concrete output-exfiltration techniques with relevant trigger keywords, but it lacks any explicit "Use when..." guidance, capping its completeness. Adding a trigger clause and more natural user-facing phrases would lift it into the top band.

Suggestions

Append an explicit trigger clause, e.g. "Use when testing for data exfiltration via model output, covert output channels, image-gen leaks, or response side-channels."

Reframe the when_to_use keyword list into natural phrases a user would actually say (e.g. "output exfiltration", "covert channel in LLM output", "timing side-channel") rather than a compact keyword dump.

Add a couple of synonyms/file-signal terms (e.g. "out-of-band exfiltration", "tool-call URL exfil") to broaden trigger coverage.

Dimension	Reasoning	Score
Specificity	Names the domain and several concrete technique categories ("Covert channels in output, schema break, exfil via image gen, side-channel via timing") rather than vague language, with only minor coverage gaps; not a 5 because the actions are condensed labels rather than a comprehensive enumerated list.	4 / 5
Completeness	It clearly states what the skill covers (output manipulation and exfiltration techniques) but provides no "Use when..." clause or equivalent explicit trigger guidance, which per the rubric caps completeness at 3.	3 / 5
Trigger Term Quality	Relevant keywords appear ("output exfil covert channel image gen timing side channel ssrf via response") but they read as a metadata keyword dump rather than natural phrases a user would say, and common synonyms/variations are missing; better than a 2 because several on-topic terms are present.	3 / 5
Distinctiveness Conflict Risk	The output-exfiltration niche is mostly distinct from generic skills, with only minor overlap risk against closely related AI-security skills (T10, T11) it cross-references; not a 5 because those adjacencies create some overlap.	4 / 5
	Total	14 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
relative_links	Relative link issues: 1 suspicious	Warning

	Total	14 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/plugins/llm-redteam/t07-output-exfil/SKILL.md
Commit: 0cf691e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.