adversarial-ml-evasion

Craft adversarial examples that cause trained ML classifiers to misclassify at inference time — image recognition, malware detectors, IDS, spam filters.

Quality

80%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/analyst/adversarial-ml-evasion/SKILL.md

Quality

Content

77%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable with executable attack code and a clear validation checklist, but it spends tokens explaining concepts Claude already knows and is a long monolithic file that could split reference material into bundle files.

Suggestions

Trim or remove the introductory concept paragraph (lines 14–18); Claude already knows what adversarial examples and FGSM/PGD are.

Move the tooling reference table and detection-signals list into a references/ file (e.g. TOOLING.md) and link to it, so SKILL.md stays a lean overview.

Flesh out the IDS-evasion snippet (§4c) with executable scapy code matching the depth of the other sections, rather than high-level comments.

Dimension	Reasoning	Score
Conciseness	The body is mostly lean executable code and tight tables, but the opening paragraph ("Adversarial examples are inputs modified with small, deliberate perturbations that reliably cause a trained classifier to produce incorrect predictions…") explains a concept Claude already knows. It is not a 3 because of that conceptual padding, and not a 1 because the bulk is efficient, copy-paste-ready code.	2 / 3
Actionability	Concrete, executable code is provided throughout — FGSM/PGD in PyTorch, C&W and HopSkipJump via IBM ART, an NES gradient estimator, adversarial patches, and a LIEF-based malware perturbation — with install commands and specific parameters. It matches the 'fully executable, copy-paste ready' anchor.	3 / 3
Workflow Clarity	The skill is sequenced Reconnaissance → White-box → Black-box → Physical → Tooling, followed by an explicit Validation checklist (§6) with checkpoints like baseline confirmation, epsilon-ball verification, and transfer success rate. Validation is present for the batch-generation operations, so it is not capped at 2 and meets the 'clear sequence with explicit validation' anchor.	3 / 3
Progressive Disclosure	Sections are well organized, but the ~250-line skill is a single monolithic SKILL.md with no external reference files (no references/, scripts/, or assets/ directories exist). It is not a 3 because it exceeds the 'under 50 lines, no external references needed' carve-out and does not signal one-level-deep references; it is not a 1 because there is no deeply nested reference chain.	2 / 3
	Total	10 / 12 Passed

Description

82%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is concrete, domain-rich, and clearly distinct, but it omits an explicit 'Use when…' trigger clause, which caps its completeness. Adding a usage trigger would round it out.

Suggestions

Append an explicit 'Use when…' clause, e.g. 'Use when the user needs to fool or evade a trained ML classifier (image, malware, IDS, spam) at inference time.'

Consider adding common user phrasings like 'fool', 'evade', or 'bypass a classifier' to broaden natural trigger coverage.

Dimension	Reasoning	Score
Specificity	"Craft adversarial examples that cause trained ML classifiers to misclassify at inference time" names a concrete action, and the dash-listed domains (image recognition, malware detectors, IDS, spam filters) enumerate multiple specific applications. It is not the level-2 'names domain and some actions' anchor because four distinct target domains are listed rather than a single vague one.	3 / 3
Completeness	The 'what' is explicit (craft adversarial examples to cause misclassification), but there is no 'Use when…' clause or equivalent explicit trigger guidance in the description field, so completeness is capped at 2 per the rubric guideline. It is not a 1 because the capability is clearly stated, and not a 3 because the 'when' is only implied.	2 / 3
Trigger Term Quality	Terms like "adversarial examples", "misclassify", "malware detectors", "IDS", and "spam filters" are the natural vocabulary a user requesting this skill would say. It exceeds the level-2 anchor ('Works with PDF files') by covering several domain-specific natural terms rather than one generic keyword.	3 / 3
Distinctiveness Conflict Risk	Adversarial-ML evasion against trained discriminative classifiers is a clear niche with distinct triggers, and it explicitly distinguishes itself from LLM jailbreaks, so it is unlikely to fire for the wrong skill.	3 / 3
	Total	11 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/analyst/adversarial-ml-evasion/SKILL.md
Commit: e34afba

Reviewed: about 16 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.