CtrlK
BlogDocsLog inGet started
Tessl Logo

apt41-double-dragon

Adversary-emulation profile for APT41 (Double Dragon / Wicked Panda / BARIUM / Brass Typhoon, ATT&CK G0096), a Chinese dual-mandate espionage-and-cybercrime actor.

66

Quality

80%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/shared/adversary-emulation/apt41-double-dragon/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

90%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is a lean, expert-level reference that assumes Claude's competence and delivers concrete, skill-mapped emulation guidance plus specific detection telemetry. Its main gap is the absence of an explicit validate→fix→retry feedback loop in the emulation workflow, though destructive actions are properly gated by ROE sign-off.

DimensionReasoningScore

Conciseness

The body is dense and information-rich with no padding, skipping basic concept explanations Claude already knows and going straight to TTP-to-technique mappings, aliases, CVEs, and named tools — every token earns its place.

5 / 5

Actionability

Emulation guidance maps each behavior to specific named Decepticon skills (recon/exploitation, c2/sliver, defense-evasion, AD, lateral-movement) and provides a concrete recommended chain; detection guidance cites specific Event IDs and telemetry — actionable for an instruction-only profile.

5 / 5

Workflow Clarity

The emulation guidance is clearly sequenced across the kill chain with an explicit recommended chain summary and a destructive-action ROE sign-off gate, but it lacks a full validate→fix→retry feedback loop typical of anchor 5.

4 / 5

Progressive Disclosure

No bundle files exist and none are strongly required; the document is well-organized into clear sections (attribution, targeting, campaigns, TTPs by tactic, tooling, emulation, detection, sources) for easy navigation, though a profile this large could optionally split detailed TTP/tooling tables.

4 / 5

Total

18

/

20

Passed

Description

70%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description precisely identifies a specific, well-aliased threat actor and stays in clean third person, but it lacks an explicit 'when to use' trigger clause, which caps completeness. Adding a 'Use when...' sentence with broader synonyms (e.g., Winnti) would raise both completeness and trigger coverage.

Suggestions

Append an explicit trigger clause, e.g. 'Use when emulating APT41/Double Dragon/Winnti or mapping Chinese dual espionage-and-cybercrime TTPs to ATT&CK.'

Add the missing common alias 'Winnti' to the description to improve trigger-term coverage and reduce the chance of a user's natural phrasing not matching.

Consider stating the concrete emulation outputs (e.g., TTP mapping, detection guidance) the skill produces to lift specificity from concrete-actor naming toward concrete deliverables.

DimensionReasoningScore

Specificity

Names a concrete domain (adversary-emulation profile) and a highly specified actor with multiple concrete aliases (Double Dragon, Wicked Panda, BARIUM, Brass Typhoon, G0096) and the dual-mandate characterization, sitting above the anchor-3 single-action level.

4 / 5

Completeness

Has a clear 'what' (an adversary-emulation profile for APT41) but no explicit 'Use when...' clause or equivalent trigger guidance, capping completeness at 3 per the rubric guideline.

3 / 5

Trigger Term Quality

Strong coverage of natural names a user would say (APT41, Double Dragon, Wicked Panda, BARIUM, Brass Typhoon) plus ATT&CK G0096, but missing some common synonyms such as Winnti and broader trigger phrasing.

4 / 5

Distinctiveness Conflict Risk

Targets a single named threat actor with multiple distinct aliases and an ATT&CK group ID, giving it a clear niche with minimal risk of triggering for the wrong skill.

5 / 5

Total

16

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

Total

15

/

16

Passed

Repository
PurpleAILAB/Decepticon
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.