api-overview

Modern API category — gRPC, SOAP/WSDL, WebSocket, Server-Sent Events. Routing skill: identify the API protocol from the response Content-Type or wire format, then load the matching sub-skill.

Quality

91%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

100%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

An exemplary lean routing skill: every section earns its place, commands are executable, and the structure cleanly points outward to the matching sub-skills. No weaknesses across the content dimensions.

Dimension	Reasoning	Score
Conciseness	The body is lean with no concept padding — it jumps to a sub-skill table, executable fingerprint commands, and a sibling-skill pointer, assuming Claude already knows what these protocols are.	3 / 3
Actionability	The "Quick fingerprint" section gives copy-paste-ready curl commands per protocol, and the sub-skill table names concrete sub-skills and wire signatures to match against.	3 / 3
Workflow Clarity	As a simple single-purpose routing skill under 50 lines, its flow (fingerprint -> identify -> load sub-skill) is unambiguous, and the fingerprint commands double as confirmation checkpoints (e.g. "101 = WS upgrade", "500 with SOAP fault").	3 / 3
Progressive Disclosure	Under 50 lines with no bundle files needed; content is split into well-organized sections (Sub-skills, Quick fingerprint, Sibling skills) with one-level-deep references to sub-skills and a sibling skill.	3 / 3
	Total	12 / 12 Passed

Description

82%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A tight, specific routing description with good trigger-term coverage and a clear niche. Its main gap is the absence of an explicit "Use when..." clause, which leaves the invocation trigger implied rather than stated.

Suggestions

Append an explicit trigger clause, e.g. "Use when the target exposes a non-REST API protocol (gRPC, SOAP/WSDL, WebSocket, or Server-Sent Events) and you need to pick the right exploitation sub-skill."

Add common shorthand variations users might say (e.g. "SSE", "WS", "WSDL") to the description itself rather than only the when_to_use metadata.

Dimension	Reasoning	Score
Specificity	Names concrete actions — "identify the API protocol from the response Content-Type or wire format, then load the matching sub-skill" — and enumerates the specific protocols, rather than vague language.	3 / 3
Completeness	It states what the skill does (identify protocol, load sub-skill) but lacks an explicit "Use when..." trigger clause, so the "when" is only implied; the rubric caps completeness at 2 in that case.	2 / 3
Trigger Term Quality	Includes the natural terms a user would say — "gRPC, SOAP/WSDL, WebSocket, Server-Sent Events" — covering the common variations for this protocol family.	3 / 3
Distinctiveness Conflict Risk	The named modern-protocol niche (gRPC/SOAP/WebSocket/SSE) is clearly distinct from REST/GraphQL skills and unlikely to trigger the wrong skill.	3 / 3
	Total	11 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/exploit/api/SKILL.md
Commit: e34afba

Reviewed: about 15 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.