api-overview

Modern API category — gRPC, SOAP/WSDL, WebSocket, Server-Sent Events. Routing skill: identify the API protocol from the response Content-Type or wire format, then load the matching sub-skill.

Quality

71%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/exploit/api/SKILL.md

Quality

Content

82%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a tight, well-structured routing skill with executable fingerprint commands and no token waste. Its main weakness is that the terminal "load the matching sub-skill" step is under-specified — the sub-skill names lack explicit load paths or commands.

Suggestions

Make the sub-skill load step executable: give the exact load command/path for each sub-skill (e.g. `load_skill("/skills/.../grpc/SKILL.md")`) as done for the sibling REST/GraphQL skill.

Add a brief explicit checkpoint after fingerprinting (e.g. confirm matched Content-Type before loading the sub-skill) to strengthen the routing workflow.

Optionally link each sub-skill name in the table to its path so the routing map is directly navigable.

Dimension	Reasoning	Score
Conciseness	The body is lean — a compact sub-skills table, four short curl fingerprints, and a one-line sibling pointer — with no padding or explanation of concepts Claude already knows; every line (including inline comments like "# 101 = WS upgrade") earns its place, matching the 5 anchor.	5 / 5
Actionability	Provides copy-paste-ready curl commands that fingerprint all four protocols, but the final "load the matching sub-skill" step gives only bare names (e.g. `grpc`, `soap-wsdl`) without the actual load path or command, a minor gap that keeps it just below fully executable (5).	4 / 5
Workflow Clarity	The two-step routing workflow (fingerprint via Content-Type/wire format, then load the matching sub-skill) is clearly sequenced with implicit checkpoints (grep match, 101 response), but the load step is not spelled out with an explicit path, so it sits at 4 rather than 5.	4 / 5
Progressive Disclosure	A short (~40 line), well-sectioned router (Sub-skills table, Quick fingerprint, Sibling skills) with one-level-deep pointers to sub-skills and a sibling skill; references to sub-skills are signaled by name only rather than full paths, a minor organization gap versus the 5 anchor.	4 / 5
	Total	17 / 20 Passed

Description

61%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and well-scoped to a distinct API-routing niche with strong natural trigger terms, but it omits any explicit "Use when..." guidance, which caps its completeness. Adding a trigger clause would raise the score meaningfully.

Suggestions

Add an explicit "Use when..." trigger clause, e.g. "Use when the target exposes a non-REST API such as gRPC, SOAP/WSDL, WebSocket, or SSE."

Include common shorthand synonyms (SSE, websockets, SOAP) alongside the full protocol names to broaden natural trigger coverage.

State the routing outcome more concretely — name the sub-skill load action and what the user gains (e.g. protocol-specific exploitation steps).

Dimension	Reasoning	Score
Specificity	Names the domain and four concrete protocols ("gRPC, SOAP/WSDL, WebSocket, Server-Sent Events") plus a concrete routing action ("identify the API protocol from the response Content-Type or wire format, then load the matching sub-skill"), but only describes a single routing action rather than multiple distinct capabilities, so it stops at the 3 anchor rather than 4.	3 / 5
Completeness	The "what" is clearly stated ("Routing skill: identify the API protocol ... then load the matching sub-skill"), but there is no "Use when..." clause or equivalent explicit trigger guidance, which per the rubric caps completeness at 3.	3 / 5
Trigger Term Quality	Good natural keyword coverage with "gRPC", "SOAP/WSDL", "WebSocket", "Server-Sent Events", and "API protocol" — terms users actually say — but common shorthand synonyms like "SSE" and "websockets" are absent, keeping it just below comprehensive (5).	4 / 5
Distinctiveness Conflict Risk	It carves a clear niche (modern non-REST/GraphQL protocols) and even points to a sibling skill for REST + GraphQL, leaving only minor overlap risk with general API skills — mostly distinct rather than a fully conflict-free niche (5).	4 / 5
	Total	14 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/exploit/api/SKILL.md
Commit: 0cf691e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.