CtrlK
BlogDocsLog inGet started
Tessl Logo

api-grpc

gRPC API exploitation — reflection-based discovery via grpcurl, protobuf fuzzing, missing authz on streaming RPCs, gRPC-Web → backend SSRF, mTLS bypass, metadata header injection, h2c smuggling against gRPC fronts.

67

Quality

81%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

SKILL.md
Quality
Evals
Security

Quality

Content

87%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A concise, highly actionable gRPC attack reference with clean structure, held back only by the absence of validation checkpoints and feedback loops for its destructive/batch operations.

Suggestions

Add explicit validation/checkpoint steps to destructive workflows (e.g. confirm target scope before running Reset, verify reflection exposure before fuzzing, and a 'review errors / re-run' feedback loop for the fuzz loop).

Add a brief scoping/authorization check before destructive RPCs like AdminService/Reset to satisfy the validation requirement and lift workflow_clarity.

DimensionReasoningScore

Conciseness

Lean and efficient throughout — every section is concrete commands plus a one-line context line with no padding or explanation of concepts Claude already knows, matching the lean score-5 anchor.

5 / 5

Actionability

Copy-paste-ready grpcurl/curl/python commands cover the common discovery and attack cases with specific flags and arguments, matching the fully-executable score-5 anchor.

5 / 5

Workflow Clarity

Discovery and fuzz steps are numbered and sequenced, but destructive/batch operations (AdminService/Reset, fuzzing) lack explicit validation checkpoints or error-feedback loops; per the rubric guideline and feedback_loops note this caps workflow_clarity at 3.

3 / 5

Progressive Disclosure

Well-organized into clear labeled sections (Discovery, Attack patterns, Fuzz strategy, OPSEC, References) with no nested or buried references; no bundle files exist, so the single-topic body with clean structure earns 5.

5 / 5

Total

18

/

20

Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A highly specific, distinctive description that names many concrete gRPC attack techniques, but it lacks an explicit 'Use when...' trigger clause, which caps its completeness score.

Suggestions

Add an explicit 'Use when...' clause, e.g. 'Use when assessing gRPC/gRPC-Web services, or when the user mentions gRPC, protobuf, grpcurl, or HTTP/2 APIs.'

Include common synonyms and file extensions (e.g. .proto, http2) to broaden trigger-term coverage toward 5.

DimensionReasoningScore

Specificity

Lists multiple concrete attack actions — 'reflection-based discovery via grpcurl', 'protobuf fuzzing', 'missing authz on streaming RPCs', 'gRPC-Web → backend SSRF', 'mTLS bypass', 'metadata header injection', 'h2c smuggling' — giving comprehensive coverage of the domain, matching the score-5 anchor.

5 / 5

Completeness

The 'what' is explicit and detailed, but there is no 'Use when...' or equivalent explicit trigger clause; per the rubric guideline a missing 'Use when...' clause caps completeness at 3.

3 / 5

Trigger Term Quality

Strong niche keywords (grpc, protobuf, grpcurl, streaming, mtls, h2c, grpc-web, envoy) that a user would naturally say, but slightly short of comprehensive synonym/extension coverage expected at 5, so it sits above the midpoint at 4.

4 / 5

Distinctiveness Conflict Risk

A clear niche (gRPC API exploitation) with highly specific, distinct triggers and minimal overlap risk with other skills, matching the score-5 anchor.

5 / 5

Total

17

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

Total

15

/

16

Passed

Repository
PurpleAILAB/Decepticon
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.