ato-methodology

Account Takeover decision tree — 9 canonical ATO paths, chaining patterns (IDOR→ATO, XSS→ATO, OAuth→ATO), MFA bypass entry points.

Quality

76%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/exploit/web/ato-methodology/SKILL.md

Quality

Content

82%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The methodology body is exceptionally lean and well-structured, with concrete endpoint examples, a clear decision tree, and appropriate cross-references to related skills. It is a strong instruction-only skill that mostly lacks only copy-paste payloads and a couple of explicit validation loops.

Dimension	Reasoning	Score
Conciseness	The body is lean throughout — terse bullets, concrete endpoints, and a compact decision tree, with no padding explaining basic concepts Claude already knows; every line earns its place.	5 / 5
Actionability	Provides concrete, specific guidance such as 'POST /api/users/me/email {email: ...}' and 'PATCH /api/users/<id>' plus named flaw classes per path; as an instruction-only methodology it is actionable, though it stops short of copy-paste-ready payloads.	4 / 5
Workflow Clarity	The decision tree gives a clear branching sequence (MFA enabled? → bypass available? → which paths) and the PoC framing includes a safety checkpoint ('Show no destructive action taken on victim's actual data'), with only minor validation gaps.	4 / 5
Progressive Disclosure	Content is well organized into clearly labeled sections and delegates detail to one-level-deep cross-references (JWT, OAuth, IDOR, XSS skills) rather than duplicating it; minor organization gaps keep it just below a 5.	4 / 5
	Total	17 / 20 Passed

Description

70%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and distinctive, naming concrete ATO paths and chaining patterns with natural trigger terms, but it lacks an explicit 'Use when...' clause that would tell Claude when to invoke it. Adding trigger guidance would raise completeness.

Suggestions

Add an explicit 'Use when...' clause (e.g., 'Use when assessing account takeover risk, hijacked sessions, MFA bypass, or chaining IDOR/XSS/OAuth into account compromise') to satisfy the 'when' half of completeness.

Surface a few more natural trigger synonyms in the description itself (credential stuffing, password spray, session hijack, email-change abuse) rather than relying on metadata.when_to_use.

Consider naming a couple more of the 9 paths beyond the three chaining examples to reduce the coverage gap in specificity.

Dimension	Reasoning	Score
Specificity	Names the ATO domain plus several concrete items ('9 canonical ATO paths', chaining patterns 'IDOR→ATO, XSS→ATO, OAuth→ATO', 'MFA bypass entry points'), with only minor gaps in coverage rather than full enumeration of all 9 paths.	4 / 5
Completeness	The 'what' is clear (decision tree, 9 paths, chaining patterns, MFA bypass entry points) but there is no 'Use when...' clause or equivalent explicit trigger guidance, capping completeness at 3 per the rubric guideline.	3 / 5
Trigger Term Quality	Includes natural pentest terms ('Account Takeover', 'ATO', 'MFA bypass', 'IDOR', 'XSS', 'OAuth') with the ATO↔Account Takeover synonym pair, though a few common variations (credential stuffing, session hijack) are absent from the description itself.	4 / 5
Distinctiveness Conflict Risk	The ATO decision-tree niche with named chaining patterns is highly distinct and unlikely to trigger for unrelated skills, with minimal conflict risk.	5 / 5
	Total	16 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/exploit/web/ato-methodology/SKILL.md
Commit: 0cf691e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.