api-grpc

gRPC API exploitation — reflection-based discovery via grpcurl, protobuf fuzzing, missing authz on streaming RPCs, gRPC-Web → backend SSRF, mTLS bypass, metadata header injection, h2c smuggling against gRPC fronts.

Quality

85%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

87%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A concise, highly actionable gRPC attack reference with executable commands and clean section organization. The main gap is the lack of validation/verification checkpoints in the discovery and batch-fuzz workflows, which caps workflow clarity at 2.

Suggestions

Add explicit verification checkpoints to the Discovery and Fuzz workflows (e.g., confirm reflection is actually enabled before relying on it, verify each enumerated method's response/error before flooding) to support a feedback loop and lift workflow clarity to 3.

Add a brief 'verify impact' step after representative attack patterns (e.g., confirm unauthorized data returned vs. a clean rejection) so destructive/batch operations include a validation phase.

Dimension	Reasoning	Score
Conciseness	Lean and code-forward with minimal prose; brief explanatory lines ('gRPC-Web translates browser HTTP → backend gRPC') convey attack-specific context Claude may not know rather than generic basics, so every token earns its place; not 2 because padding is negligible.	3 / 3
Actionability	Provides concrete, executable commands with real flags — 'grpcurl -plaintext ... list', 'curl ... --http2', 'python3 h2csmuggler.py ...', 'mayhem run ...' — copy-paste ready with target placeholders; not 2 because guidance is complete rather than pseudocode.	3 / 3
Workflow Clarity	Discovery and Fuzz strategy use numbered sequences, but there are no validation/verification checkpoints, and the batch fuzz enumeration lacks a feedback loop, so workflow clarity is capped at 2 per the destructive/batch guideline; not 1 because sequences are explicitly present.	2 / 3
Progressive Disclosure	Self-contained skill with clear sections (Discovery, Attack patterns, Fuzz strategy, OPSEC, References) and clearly signaled one-level external references, no nested or broken refs; not 2 because organization and navigation are clean with no content mis-split.	3 / 3
	Total	11 / 12 Passed

Description

82%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A specific, well-scoped offensive-security description that enumerates concrete gRPC attack techniques with strong trigger terms. Its main weakness is the absence of an explicit 'Use when...' clause, which caps completeness at 2.

Suggestions

Append an explicit 'Use when...' clause naming the trigger situations (e.g., 'Use when testing gRPC/protobuf APIs, server reflection, gRPC-Web, mTLS, or h2c fronted services') to lift completeness to 3.

Add a couple of user-natural phrasings like 'gRPC API testing' or 'protobuf security' alongside the technical attack names to broaden trigger coverage.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'reflection-based discovery via grpcurl, protobuf fuzzing, missing authz on streaming RPCs, gRPC-Web → backend SSRF, mTLS bypass, metadata header injection, h2c smuggling' — matching the multi-action anchor; not below since it is comprehensive, not above as 3 is the max.	3 / 3
Completeness	Strong 'what' via the enumerated attacks, but there is no explicit 'Use when...' trigger clause, so 'when' is only implied and completeness is capped at 2 per the judging guidelines; not 1 because 'what' is clearly and richly answered.	2 / 3
Trigger Term Quality	Covers natural terms a gRPC security tester would say — 'gRPC, grpcurl, protobuf fuzzing, mTLS, h2c, gRPC-Web, SSRF, streaming' — with good variation; would not score 2 because common variations are well represented.	3 / 3
Distinctiveness Conflict Risk	A clear niche (gRPC API exploitation) with distinct triggers unlikely to fire for unrelated skills; not 2 because the domain is sharply scoped rather than broadly overlapping.	3 / 3
	Total	11 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/exploit/api/grpc/SKILL.md
Commit: e34afba

Reviewed: about 15 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.