adversary-emulation

Threat-informed adversary emulation — pick a real APT, load its profile, and reproduce its TTPs within RoE scope to test detection & response. Index of available actor profiles + the emulation methodology.

Quality

71%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/shared/adversary-emulation/SKILL.md

Quality

Content

63%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-organized methodology with a clear, scoped workflow and good conciseness, but it inlines a large actor catalog that belongs in a reference file and never links the actual bundle references, and the emulation steps lack executable per-step commands.

Suggestions

Move the 22-row actor catalog into a dedicated reference file (e.g. references/actor-catalog.md) and link it from the body with a one-line 'See [actor-catalog.md] for the full profile index', keeping only 3-4 representative profiles inline.

Link the existing references (anyrun-free-iocs.md, cve-apt-mapping.md) from the relevant methodology steps so the bundle is discoverable and navigation is one level deep.

Add at least one concrete, copy-paste-ready command or snippet illustrating a single TTP emulation proof (e.g. a canary-file Impact proof) to lift actionability.

Dimension	Reasoning	Score
Conciseness	Mostly efficient and assumes Claude's competence; the opening definitional paragraph ('reproduces a specific, named threat actor's tactics, techniques and procedures... distinct from generic penetration testing') explains somewhat more than strictly needed, but it is tight rather than padded, sitting above the 3 anchor.	4 / 5
Actionability	Concrete commands are present (load_skill <slug>, ask_user_question, kill-chain ordering with ATT&CK IDs) but the emulation steps are instructional rather than copy-paste executable — there is no runnable code or precise per-TTP reproduction command, matching the 'concrete guidance but incomplete / pseudocode-style' anchor.	3 / 5
Workflow Clarity	The 5-step methodology is clearly sequenced with scope checks at step 3 and explicit 'forbidden-destination / out-of-scope checks still apply at tool-call time' plus a measurement/reporting step; destructive Impact is explicitly down-scoped to non-destructive proofs, giving a clear sequence with most checkpoints present.	4 / 5
Progressive Disclosure	The body inlines a 22-row actor catalog table rather than pointing to a separate catalog file, and the references/ directory (anyrun-free-iocs.md, cve-apt-mapping.md) is never linked from the body — structure exists but the obvious externalized content is not signaled, placing it between the 3 and 4 anchors.	3 / 5
	Total	14 / 20 Passed

Description

78%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that distinguishes the skill well and lists concrete actions, but it lacks an explicit 'Use when...' trigger clause and a few natural synonyms that would push it to the top level.

Suggestions

Add an explicit 'Use when...' clause naming the trigger situations (e.g. purple-team/ATT&CK engagements, when an actor is named in roe.json).

Surface 1-2 high-recall trigger synonyms directly in the description text (e.g. 'emulate APT', 'threat actor', 'purple team') rather than relying only on metadata.

Dimension	Reasoning	Score
Specificity	Names the domain ('adversary emulation') and several concrete actions — 'pick a real APT, load its profile, and reproduce its TTPs within RoE scope to test detection & response' — but stops short of enumerating the full set of operations (catalog/indexing, reporting) so it sits below the comprehensive 5.	4 / 5
Completeness	It clearly states what ('pick a real APT, load its profile, and reproduce its TTPs') but the 'when' is implicit (when emulating an adversary) rather than an explicit 'Use when...' trigger clause, capping it at 4 rather than 5.	4 / 5
Trigger Term Quality	Includes strong natural phrases users say ('adversary emulation', 'APT', 'TTPs', 'threat-informed', 'detection & response') but is missing common synonyms or the explicit actor names that appear only in metadata, so not quite a 5.	4 / 5
Distinctiveness Conflict Risk	A clear niche — threat-informed adversary emulation with APT profiles and RoE scoping — with distinct triggers unlikely to fire for unrelated skills, matching the 'clear niche, minimal conflict risk' anchor.	5 / 5
	Total	17 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/shared/adversary-emulation/SKILL.md
Commit: 0cf691e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.