CtrlK
BlogDocsLog inGet started
Tessl Logo

apt37-reaper

Adversary-emulation profile for APT37 (G0067 / Reaper / ScarCruft / Ricochet Chollima / InkySquid / Group123), North Korea's RGB cyber-espionage actor.

57

Quality

66%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/shared/adversary-emulation/apt37-reaper/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

62%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The profile is well-structured, distinctive, and offers concrete emulation guidance mapped to capabilities with strong safety caveats, but it carries substantial inlined reference content (campaigns, malware catalog) that a leaner SKILL.md could push into separate files, and it lacks explicit validation checkpoints.

Suggestions

Move the full campaigns list and signature-tooling table into a references/ file (e.g. references/campaigns.md) and keep only a brief summary inline, improving progressive disclosure and conciseness.

Add explicit validation checkpoints in the emulation workflow (e.g. confirm RoE/scope before each phase, verify lab isolation before destructive steps) to lift workflow clarity.

Trim background prose Claude already knows (e.g. explanations of what ATT&CK tactics mean) to tighten token efficiency.

DimensionReasoningScore

Conciseness

It is mostly efficient reference material, but the lengthy campaigns list, per-malware table, and TTP-by-tactic narrative restate well-known ATT&CK context Claude already has, so it could be tightened without losing actionable value.

3 / 5

Actionability

The 'Emulation guidance' section maps each signature play to concrete Decepticon capabilities and skills (phishing/payload-builder, web-compromise, c2 skill, Sliver) with specific CVEs, registry keys, and API call chains, giving mostly executable direction with minor gaps.

4 / 5

Workflow Clarity

The emulation guidance is sequenced by kill-chain phase with an explicit authorized-use caveat and lab-only boundary for destructive actions; it lacks explicit validate/verify checkpoints between phases, which keeps it just below a 5.

4 / 5

Progressive Disclosure

It is a single monolithic SKILL.md with no bundle files; the heavy campaign/malware reference material is inlined rather than split into reference files, so structure is decent but content that could live separately is all inline.

3 / 5

Total

14

/

20

Passed

Description

71%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is highly distinctive and rich in natural alias-based trigger terms, but it states what the profile is without listing concrete actions or an explicit 'Use when...' clause, which caps completeness at 3 and leaves specificity slightly under full marks.

Suggestions

Add an explicit 'Use when...' trigger clause, e.g. 'Use when emulating APT37/Reaper/ScarCruft TTPs or planning a red-team engagement against this actor.'

Name concrete actions the skill performs (e.g. 'maps APT37 TTPs to emulation capabilities, lists signature malware and C2 patterns') rather than only describing the profile.

Keep the alias list but consider trimming the parenthetical to reduce length once a Use-when clause is added.

DimensionReasoningScore

Specificity

It names the domain (adversary-emulation profile) and concrete content (APT37, all tracked aliases, North Korean RGB espionage), but lists no concrete actions the skill performs — it describes what the profile is rather than what the skill does.

4 / 5

Completeness

It gives a clear 'what' (an adversary-emulation profile for APT37) but has no 'when'/Use-when clause or explicit trigger guidance, so it stops at the clear-what/missing-when anchor; per the rubric a missing trigger clause caps completeness at 3.

3 / 5

Trigger Term Quality

It packs the natural trigger vocabulary a user would say — APT37, Reaper, ScarCruft, Ricochet Chollima, InkySquid, Group123, G0067 — covering synonyms comprehensively so the skill surfaces for any alias.

5 / 5

Distinctiveness Conflict Risk

It targets a single, uniquely named actor with all its aliases and the RGB niche — a clear, narrow trigger space with minimal risk of matching another skill.

5 / 5

Total

17

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

Total

15

/

16

Passed

Repository
PurpleAILAB/Decepticon
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.