bootloader-uboot

U-Boot bootloader attack playbook — console interrupt to break the autoboot countdown, environment variable inspection and manipulation, bootargs override to spawn init=/bin/sh, secure-boot bypass techniques, and fault-injection basics (voltage and clock glitching). Covers MIPS, ARM, and AArch64 targets.

Quality

79%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/iot/bootloader-uboot/SKILL.md

Quality

Content

83%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A lean, highly actionable attack playbook with strong sequencing, limited mainly by the absence of explicit validation checkpoints for its destructive operations and the lack of bundle-file separation.

Suggestions

Add explicit validation checkpoints before destructive steps (e.g., 'Verify mtdparts matches expected layout; only then run sf erase', and 'Confirm scope permits persistence before saveenv') to lift workflow_clarity above the destructive-skill cap of 3.

Move the full scripted-interrupt and ChipWhisperer Python scripts into a scripts/ bundle file and reference them from SKILL.md to improve progressive disclosure and keep the overview lean.

Add a brief rollback/verification feedback loop (verify shell obtained → remount rw → confirm backdoor → document evidence) as an explicit checklist for the post-exploitation phase.

Dimension	Reasoning	Score
Conciseness	The body is dense and operational — commands and code dominate with only a one-line framing blockquote; it assumes Claude's competence and avoids padded explanations of what U-Boot is, so every token earns its place.	5 / 5
Actionability	Provides copy-paste-ready commands and complete scripts across the common cases — `setenv bootargs "… init=/bin/sh"`, `run bootcmd`, `saveenv`, `sf erase/write`, plus full ChipWhisperer and scripted-interrupt Python scripts — covering the primary exploitation primitives.	5 / 5
Workflow Clarity	Phases 1–6 are clearly sequenced and include revert steps and OPSEC warnings, but this is a destructive/persistence skill (saveenv, sf erase/write, glitching) without explicit validate-then-proceed checkpoints, so the destructive-skill cap holds it at 3.	3 / 5
Progressive Disclosure	Well-organized into clearly headed sections with an external References list, but no bundle files exist and substantial inlined content (the full scripted-interrupt and ChipWhisperer scripts) could be split into a scripts/ file, leaving minor organization gaps.	4 / 5
	Total	17 / 20 Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A highly specific, concrete description with a clear niche and rich trigger terms, weakened only by the absence of an explicit 'Use when' clause in the description field itself.

Suggestions

Add an explicit 'Use when…' trigger clause to the description field (e.g., 'Use when attacking U-Boot via UART console, breaking autoboot, overriding bootargs, or bypassing secure boot') so completeness is not capped at 3.

Move or mirror the strongest natural-language trigger phrases from metadata.when_to_use into the description so users' likely phrasings appear inline.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions tied to specific primitives — 'console interrupt to break the autoboot countdown', 'environment variable inspection and manipulation', 'bootargs override to spawn init=/bin/sh', 'secure-boot bypass techniques', and 'fault-injection basics (voltage and clock glitching)' — giving comprehensive coverage.	5 / 5
Completeness	The 'what' is clear and detailed, but the description field lacks an explicit 'when should Claude use it' trigger clause — the when guidance lives in metadata.when_to_use rather than in description, so per the missing-'Use when' cap it cannot exceed 3.	3 / 5
Trigger Term Quality	Natural keywords like 'bootloader', 'secure-boot bypass', 'fault-injection', and 'glitching' appear, and metadata.when_to_use adds rich synonyms, but the description field itself lacks the colloquial 'Use when…' phrasings a user would naturally say.	4 / 5
Distinctiveness Conflict Risk	'U-Boot bootloader attack playbook' with primitives like autoboot, bootargs, init=/bin/sh, and glitching on MIPS/ARM/AArch64 is a sharply defined niche with distinct triggers and minimal overlap with other skills.	5 / 5
	Total	17 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/iot/bootloader-uboot/SKILL.md
Commit: a04f96b

Reviewed: 5 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.