c2-domain-fronting

Domain fronting and CDN abuse for C2 concealment — CloudFront, Azure CDN, Fastly setup, TLS SNI vs Host header technique, CDN-based redirectors, and integration with Cobalt Strike and Sliver.

Quality

73%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/post-exploit/c2-domain-fronting/SKILL.md

Quality

Content

71%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with copy-paste-ready provider setups, redirector code, and full C2 profiles, and a clear decision gate sequences the workflow. It loses points on conciseness (conceptual re-explanation) and progressive disclosure (monolithic inlining of large configs with no reference files).

Suggestions

Trim the opening conceptual explanation and ASCII diagram of the SNI/Host mismatch — Claude already knows this — and lead with the actionable setup.

Move the large inlined artifacts (Malleable C2 profile, Sliver HTTP C2 JSON, Cloudflare Worker, nginx config) into separate reference files under ./references/ and link to them from the body, keeping only a representative snippet inline.

Add an explicit validation checkpoint after each provider setup (e.g., 'Verify fronting succeeds before integrating with the C2 profile; on HTTP 403, follow the failure-mode table') to strengthen feedback loops.

Dimension	Reasoning	Score
Conciseness	The bulk is dense, actionable config/code, but the opening prose and ASCII diagram re-explain the SNI/Host concept Claude largely already knows, and several detection/mitigation tables add educational padding.	3 / 5
Actionability	Provides fully executable, copy-paste-ready commands and configs across the common cases — aws/az CLI, Fastly API curl, Cloudflare Worker, nginx, Cobalt Strike Malleable C2 profile, and Sliver HTTP C2 JSON profile.	5 / 5
Workflow Clarity	A decision-gate tree and numbered per-provider steps give a clear sequence with a curl-test checkpoint and failure-mode tables, but explicit 'validate-then-proceed' feedback loops are thin.	4 / 5
Progressive Disclosure	Well-organized with clear section headers, but it is a ~488-line monolith with no bundle files and large config profiles inlined that could be split into one-level-deep reference files.	3 / 5
	Total	15 / 20 Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is highly specific and distinct, naming concrete providers, techniques, and C2 framework integrations. Its main weakness is the absence of an explicit 'Use when...' trigger clause, which caps completeness.

Suggestions

Append an explicit 'Use when...' trigger clause (e.g., 'Use when setting up domain-fronted or CDN-based C2 redirectors, or when the user mentions CloudFront/Azure CDN/Fastly fronting, SNI/Host mismatch, or CDN C2 concealment.') to raise completeness above 3.

Add a few plain-language synonyms alongside the technical jargon (e.g., 'CDN-based C2', 'hiding C2 traffic behind a CDN') to broaden natural trigger coverage.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete capabilities — CloudFront/Azure/Fastly setup, SNI-vs-Host technique, CDN-based redirectors, and Cobalt Strike/Sliver integration — giving comprehensive coverage of the domain.	5 / 5
Completeness	Clearly states 'what' the skill does but contains no explicit 'Use when...' trigger clause, so per the rubric completeness is capped at 3.	3 / 5
Trigger Term Quality	Strong technical keyword coverage (domain fronting, CDN, CloudFront, SNI, redirector, Cobalt Strike, Sliver) but jargon-heavy, missing a few plain-language synonyms a general user might say.	4 / 5
Distinctiveness Conflict Risk	Targets a narrow, well-defined niche (domain fronting for C2 concealment) with named providers and frameworks, giving minimal overlap risk with other skills.	5 / 5
	Total	17 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/post-exploit/c2-domain-fronting/SKILL.md
Commit: 31e1c8e

Reviewed: 9 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.