asrep-roasting

Request AS-REP for accounts with DONT_REQ_PREAUTH set and crack offline — like kerberoast but no auth required.

Quality

71%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/ad/asrep-roasting/SKILL.md

Quality

Content

76%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, concise offensive-security playbook with copy-paste commands and good section structure. Its main gap is the absence of validation/verification checkpoints in the batch crack workflow, which caps workflow clarity.

Suggestions

Add explicit validation checkpoints between steps, e.g. verify /tmp/asrep.hashes is non-empty before cracking, and confirm cracked credentials before promoting them to the graph.

Consider moving OPSEC, CVSS, and Defender-fix material into a short reference file to keep SKILL.md a leaner overview, which would also strengthen progressive disclosure.

Dimension	Reasoning	Score
Conciseness	Largely lean and assumes Claude's domain competence — no padding about what Kerberos/AS-REP is — with only minor editorial asides (the 2014 anecdote, crack-rate commentary) that could be trimmed.	4 / 5
Actionability	Fully executable, copy-paste-ready commands throughout (BloodHound query, ldapsearch, kerbrute, GetNPUsers.py, hashcat, john, Set-ADAccountControl) covering the common zero-auth and with-creds paths.	5 / 5
Workflow Clarity	A clear numbered sequence (identify → request → crack → promote) exists, but there are no validation/verification checkpoints for this batch operation (mass AS-REP request + wordlist cracking), so workflow clarity is capped at 3.	3 / 5
Progressive Disclosure	Well-organized into clear sections (Prerequisite, steps 1-5, OPSEC, CVSS, Defender fix) with content appropriately placed; no bundle files exist and none are strictly needed for this focused playbook, though it slightly exceeds the 50-line simple-skill threshold.	4 / 5
	Total	16 / 20 Passed

Description

66%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A specific, well-targeted description that names concrete actions and a clear niche, but it lacks an explicit 'Use when' trigger clause, which caps completeness. Trigger-term coverage is strong for the domain.

Suggestions

Add an explicit trigger clause, e.g. 'Use when performing AS-REP roasting, enumerating pre-auth-disabled accounts, or when the user mentions AS-REP/kerberoasting without credentials.'

Include a few more natural synonyms (e.g. 'AS-REP roasting', 'pre-auth') to broaden trigger-term coverage toward a 5.

Dimension	Reasoning	Score
Specificity	Names the domain and two concrete, specific actions — 'Request AS-REP for accounts with DONT_REQ_PREAUTH set' and 'crack offline' — with the exact technical flag, which is noticeably more specific than the score-3 anchor's generic example.	4 / 5
Completeness	Has a clear 'what' (request AS-REP and crack offline) but no explicit 'Use when...' trigger clause, so per the judging guidelines completeness is capped at 3.	3 / 5
Trigger Term Quality	Contains natural domain terms a practitioner would say ('AS-REP', 'kerberoast', 'DONT_REQ_PREAUTH', 'no auth') with good coverage, though a few synonyms/variations are missing.	4 / 5
Distinctiveness Conflict Risk	Carves a clear niche (AS-REP roasting) and the 'like kerberoast but no auth required' comparator distinguishes it, with only minor overlap risk against a kerberoast skill.	4 / 5
	Total	15 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
metadata_field	'metadata' should map string keys to string values	Warning

	Total	14 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/ad/asrep-roasting/SKILL.md
Commit: 0cf691e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.