chain-credential-reuse

Build chains where leaked or weak credentials pivot across services to privileged access.

Quality

63%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/analyst/chains/cred-reuse/SKILL.md

Quality

Content

72%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is admirably concise and well-structured for a simple graph-modeling skill, but its steps are hint-level rather than actionable and it lacks the validation checkpoints that an impactful credential-pivoting workflow should include.

Suggestions

Make the canonical path steps more concrete and actionable, e.g. specify how to test a reused credential against an adjacent service or how to confirm elevated access after escalation.

Add a validation/verification checkpoint after pivoting (e.g. confirm effective privileges / scope of access before declaring the crown jewel reached) to lift workflow clarity above the destructive-operation cap of 3.

Optionally include a short concrete graph snippet showing the `credential` -> `auth_as` -> `grants` edge pattern to turn the modeling guidance into copy-paste-ready instruction.

Dimension	Reasoning	Score
Conciseness	The body is a lean 11 lines with no padding or over-explanation of concepts Claude already knows; every line (canonical path steps, node/edge types) earns its place.	5 / 5
Actionability	It names concrete modeling primitives (`credential` nodes, `auth_as` and `grants` edges), but the path steps are hint lists ('leak, default, weak hash crack') rather than executable or fully specified guidance, leaving key details missing.	3 / 5
Workflow Clarity	A clear three-step sequence is present (Obtain -> Reuse -> Escalate), but there are no validation/verification checkpoints, and because credential pivoting to privileged access is an impactful/destructive operation the rubric caps workflow clarity at 3.	3 / 5
Progressive Disclosure	Under 50 lines with no need for external references and no bundle files present; the two well-organized sections (Canonical path, Graph guidance) satisfy the simple-skill exception for a top score.	5 / 5
	Total	16 / 20 Passed

Description

53%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description clearly states what the skill does within a well-defined niche, but it lacks an explicit 'Use when...' trigger clause and relies on mostly technical keywords, leaving it at mid-rubric levels for completeness and trigger quality.

Suggestions

Append an explicit trigger clause, e.g. 'Use when mapping how leaked or weak credentials can be reused to pivot across services and reach privileged access.'

Broaden trigger terms in the description itself (rather than only in when_to_use) with natural phrases like 'credential reuse', 'password reuse', 'SSO/OAuth pivot'.

List one or two more concrete actions (e.g. 'crack weak hashes', 'enumerate shared SSO/OAuth trusts') to lift specificity toward comprehensive coverage.

Dimension	Reasoning	Score
Specificity	Names the domain (credential reuse) and the concrete actions 'Build chains', 'pivot across services', and 'reach privileged access', but these compose essentially one composite action rather than a comprehensive list of specific actions.	3 / 5
Completeness	Has a clear 'what' (build credential-reuse pivot chains) but no 'Use when...' clause or equivalent explicit trigger guidance in the description, which caps completeness at 3 per the rubric guideline.	3 / 5
Trigger Term Quality	Contains relevant keywords ('leaked or weak credentials', 'pivot', 'privileged access') but they lean technical and miss common natural variations a user might say; the richer trigger terms live in the separate when_to_use metadata, not the description.	3 / 5
Distinctiveness Conflict Risk	Targets a clear niche (credential reuse chaining to privileged access) with distinct triggers, carrying only minor overlap risk with other credential-access skills.	4 / 5
	Total	13 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/analyst/chains/cred-reuse/SKILL.md
Commit: 0cf691e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.