cache-deception

Web cache deception — trick CDN/proxy into caching authenticated responses under unauthenticated URLs, exposing PII to any visitor.

Quality

67%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/exploit/web/cache-deception/SKILL.md

Quality

Content

77%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable with executable probe and PoC code and a clear validation checkpoint, but it is a monolithic single file with no progressive disclosure to deeper references and carries dated exemplar content that lightly hurts token efficiency.

Suggestions

Move the 'Known exemplars' dated entries (2017, 2023) into a clearly labeled deprecated/old-reports section, or drop the specific years, to remove the time-sensitive conciseness penalty.

Split heavier detail — the variants table, severity rubric, and defender configs — into one-level-deep reference files (e.g. references/variants.md, references/defender.md) signaled from the overview, to add progressive disclosure.

Add a one-line 'Prerequisites' note (authed session value, TARGET env var) so the curl/Python snippets are fully self-contained for first-time execution.

Dimension	Reasoning	Score
Conciseness	The body is mostly lean and assumes Claude's competence (no CDN/CDN-caching primer), but the 'Known exemplars' section carries time-sensitive dates (2017, 2023) outside any deprecated/old-patterns section, which the guidelines say should penalize conciseness.	2 / 3
Actionability	It provides copy-paste-ready, executable guidance throughout — curl probe commands, a runnable Python PoC with asserts, an nginx defender config, and a concrete variants table — with only variables like $TARGET/$AUTH left to substitute.	3 / 3
Workflow Clarity	The probe flow is a clear two-step sequence with an explicit validation checkpoint ('If the second request returns the AUTHENTICATED content of step 1 → deception confirmed') and the PoC reinforces it with assertions; this is not a destructive/batch operation, so no error-recovery loop is required.	3 / 3
Progressive Disclosure	No bundle files exist (references/scripts/assets absent) and all content lives in a single ~110-line monolithic file; it is well-organized into sections but exceeds the under-50-line simple-skill threshold and does not split detail into one-level-deep referenced files.	2 / 3
	Total	10 / 12 Passed

Description

57%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific to a clear niche and uses recognizable security terms, but it omits an explicit 'when to use' trigger clause and describes only one action, leaving it solid but not exemplary.

Suggestions

Add an explicit trigger clause, e.g. 'Use when testing CDN/proxy caching behavior for authenticated-endpoint leakage, or when the user mentions cache deception, PII exposure via cache, or Cloudflare/CloudFront/Akamai caching quirks.'

Broaden natural-language trigger terms to include variations users actually say ('CDN caching bug', 'cache leak', 'authenticated response cached').

List more than one concrete action (e.g. probe suffixes, confirm via unauth re-request, triage severity) to lift specificity toward a comprehensive action set.

Dimension	Reasoning	Score
Specificity	The description names the domain and one concrete action — 'trick CDN/proxy into caching authenticated responses under unauthenticated URLs, exposing PII to any visitor' — but lists a single action rather than multiple specific ones, so it is not comprehensive.	2 / 3
Completeness	It clearly states what the skill does but lacks an explicit 'Use when...' clause or equivalent trigger guidance; per the judging guidelines a missing explicit trigger caps completeness at 2.	2 / 3
Trigger Term Quality	Natural terms a security tester would say are present ('Web cache deception', 'CDN/proxy', 'PII'), but coverage of common variations is thin and the phrasing leans on jargon ('authenticated responses under unauthenticated URLs') rather than broad natural language.	2 / 3
Distinctiveness Conflict Risk	'Web cache deception' is a well-defined niche with distinct triggers and is explicitly separated from cache poisoning in the body, making it unlikely to fire for the wrong skill.	3 / 3
	Total	9 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/exploit/web/cache-deception/SKILL.md
Commit: e34afba

Reviewed: about 15 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.