analyst-overview
Root pointer for the analyst's vulnerability research playbooks. Load this first at iteration start to see the full catalog of vuln-class and chain-building skills.
62
73%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Critical
Do not install without reviewing
Fix and improve this skill with Tessl
tessl review fix ./packages/decepticon/decepticon/skills/standard/analyst/SKILL.mdAnalyst Skill Catalog
The analyst has specialised playbooks under this tree. Load the one matching your current hunting lane — don't load them all at once.
Taint / source-review playbooks
Use when you have source code and are hunting a specific weakness class.
| Skill | Use for |
|---|---|
/skills/standard/analyst/sql-injection/SKILL.md | String-concat + format-string → SQL sink |
/skills/standard/analyst/ssrf/SKILL.md | User-controlled URL reaches http client |
/skills/standard/analyst/deserialization/SKILL.md | pickle / Java ObjectInputStream / .NET BinaryFormatter / YAML |
/skills/standard/analyst/ssti/SKILL.md | User input rendered by Jinja/Twig/Freemarker/Velocity |
/skills/standard/analyst/xxe/SKILL.md | XML parser with external entity expansion enabled |
/skills/standard/analyst/path-traversal/SKILL.md | User input reaches filesystem path |
/skills/standard/analyst/prototype-pollution/SKILL.md | JS merge / assign / clone of untrusted object |
/skills/standard/analyst/command-injection/SKILL.md | User input → shell, exec, system |
/skills/standard/analyst/idor/SKILL.md | Missing authorization check on object reference |
/skills/standard/analyst/auth-bypass/SKILL.md | Broken auth state machine, missing session checks |
/skills/standard/analyst/prompt-injection/SKILL.md | LLM prompts built from untrusted input |
Chain playbooks
Use when you have a bag of individual findings and want to combine them into a critical impact chain.
| Skill | Use for |
|---|---|
/skills/standard/analyst/chains/ssrf-to-rce/SKILL.md | SSRF → metadata → IAM → RCE |
/skills/standard/analyst/chains/xss-to-takeover/SKILL.md | Self-XSS → CSRF → admin creds |
/skills/standard/analyst/chains/cred-reuse/SKILL.md | Low-priv cred → service pivot → domain admin |
/skills/standard/analyst/chains/idor-to-priv-esc/SKILL.md | IDOR on settings → role elevation |
Workflow
kg_stats— see what you already know.- Identify the target's language / framework.
- Load the matching vuln-class skill (one or two per iteration).
- Run the skill's recipe, record findings as graph nodes.
- When enough vulns exist, load a chain playbook and call
plan_attack_chains(promote=True)to persist any complete chains.
- Repository
- PurpleAILAB/Decepticon
- Commit
e34afba
- Last updated
- First committed
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.