active-recon

Active target probing — port scanning, service detection, vulnerability scanning, banner grabbing, web directory fuzzing, SSL/TLS analysis.

Quality

70%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/recon/active-recon/SKILL.md

Quality

Content

65%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with executable commands and a clear sequenced workflow, but it is a large monolithic file with redundancy and lacks explicit validation checkpoints for its destructive/batch scanning operations.

Suggestions

Add explicit validation/scope-check checkpoints to the workflow (e.g., confirm target is in authorized scope before each scan; verify scan output file was written before proceeding).

Move per-service enumeration and tool-flag reference tables into separate reference files under references/ and link to them, reducing the SKILL.md to an overview plus quick-start.

De-duplicate the scan patterns that appear in both the Quick Reference and section 2 to tighten the token budget.

Dimension	Reasoning	Score
Conciseness	Mostly tight command snippets and tables with little concept-over-explanation, but the ~390-line body duplicates scan patterns between the Quick Reference and section 2 and could be trimmed.	3 / 5
Actionability	Provides fully executable, copy-paste-ready commands with concrete flags across nmap, ffuf, nuclei, nikto, testssl, and nc, covering the common per-service cases.	5 / 5
Workflow Clarity	Section 12 gives a clear 11-step sequence and the error/pitfalls sections aid recovery, but destructive/batch scanning lacks explicit validation checkpoints (e.g., verify scope/scope-check before scanning), capping this at 3 per the batch-operation rule.	3 / 5
Progressive Disclosure	Well-structured with 14 numbered sections, but it is a monolithic single file with no references/ scripts/ or assets/ and content (per-service enumeration, tool reference) that could live in separate files is inlined.	3 / 5
	Total	14 / 20 Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and well-scoped with concrete capabilities, but omits an explicit "Use when..." trigger clause, which caps its completeness. Trigger terms are relevant but lack natural user phrasing and synonyms.

Suggestions

Add an explicit trigger clause, e.g. "Use when the user wants to port scan, detect services, grab banners, run nuclei/nikto, or analyze SSL/TLS on a target."

Include natural synonyms and file/protocol extensions a user might mention (e.g. "nmap", "nuclei", "testssl", "scan open ports") to broaden trigger coverage.

Keep the concise action list but pair it with the when-clause so both what and when are explicitly answered.

Dimension	Reasoning	Score
Specificity	Lists six concrete, distinct actions ("port scanning, service detection, vulnerability scanning, banner grabbing, web directory fuzzing, SSL/TLS analysis"), giving comprehensive coverage of the active-recon domain.	5 / 5
Completeness	The "what" is clear and concrete, but there is no explicit "Use when..." trigger clause; per the guidelines, a missing explicit when-clause caps completeness at 3.	3 / 5
Trigger Term Quality	Includes several natural terms a user might say ("port scan", "vulnerability scan", "SSL analysis"), but stops short of comprehensive synonyms/extensions and reads more as technical jargon than natural phrasing.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (active target probing with named scan techniques) with distinct triggers and minimal overlap risk with unrelated skills.	5 / 5
	Total	17 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/recon/active-recon/SKILL.md
Commit: 31e1c8e

Reviewed: 10 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.