chain-ssrf-to-rce

Build and validate SSRF pivot chains toward metadata/infra control and final code execution impact.

Quality

64%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/analyst/chains/ssrf-to-rce/SKILL.md

Quality

Content

72%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is concise and well-organized into a clear canonical path and graph guidance, with named tooling functions. Its main weakness is actionability and workflow rigor: the chain steps are abstract rather than executable and lack an explicit validation/error-recovery feedback loop for a destructive operation.

Suggestions

Add concrete, executable detail to the canonical path steps (e.g., specific IMDS URL targets, curl/gopher payloads, or token-retrieval commands) so guidance is copy-paste ready rather than descriptive.

Insert an explicit validation/feedback loop for the destructive RCE outcome, e.g., "Verify execution via callback/echo; if no callback, re-check credential scope and retry the deploy step" to move workflow_clarity to anchor 3.

Optionally reference a worked example payload file under `references/` so the overview stays lean while concrete execution detail lives one level deep.

Dimension	Reasoning	Score
Conciseness	The body is lean with no concept explanations Claude already knows — every line ("Add `enables` edges for each pivot", "Run `plan_attack_chains`...") earns its place, matching anchor 3; it is not the padded anchor 1 or the slightly-loose anchor 2.	3 / 3
Actionability	Concrete elements exist (named functions `plan_attack_chains` / `suggest_objectives_from_chains` and `enables` edge guidance) but the canonical-path steps are abstract descriptions ("Extract credential/token", "Use credential to deploy payload") with no executable commands, matching anchor 2 rather than the copy-paste-ready anchor 3 or the no-guidance anchor 1.	2 / 3
Workflow Clarity	A clear four-step "Canonical path" sequence with a confirm checkpoint (step 4) is present, but for a destructive RCE chain there is no explicit validate→fix→retry feedback loop, so it matches anchor 2 (steps listed, checkpoints implicit) rather than anchor 3 (explicit validation with error-recovery loops).	2 / 3
Progressive Disclosure	The skill is well under 50 lines with no bundle files and is organized into clear sections ("Canonical path", "Graph guidance"); per the simple-skill guideline this earns anchor 3 without external references, avoiding the monolithic anchor 1 and the inline-bloat anchor 2.	3 / 3
	Total	10 / 12 Passed

Description

57%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific to a distinct SSRF-to-RCE chaining niche and answers "what" clearly, but it lacks an explicit "when to use" trigger clause and uses jargon-heavy terms over natural user keywords. Adding a "Use when..." clause with plain-language trigger terms would lift completeness and trigger-term quality.

Suggestions

Add an explicit trigger clause such as "Use when chaining an SSRF finding into cloud metadata theft (IMDS/IAM), gopher/DNS rebinding pivots, or remote code execution." to satisfy the completeness "when" requirement.

Soften jargon with natural terms a user would actually say (e.g., "SSRF", "RCE", "cloud metadata", "IMDS", "IAM role") alongside "pivot chains" and "infra control".

Enumerate a couple more concrete actions (e.g., "steal IMDS credentials, pivot to internal admin APIs, deploy payloads") to move specificity toward a comprehensive action list.

Dimension	Reasoning	Score
Specificity	Quotes "Build and validate SSRF pivot chains toward metadata/infra control and final code execution impact" — it names the domain and a couple of actions (Build, validate) but does not list multiple specific concrete actions like the anchor-3 example, so it sits at level 2 rather than 1 (not vague) or 3 (not a comprehensive action list).	2 / 3
Completeness	Clearly states what the skill does but has no "Use when..." or equivalent explicit trigger clause in the description; per the judging guidelines a missing trigger clause caps completeness at 2, so it cannot reach anchor 3 while remaining above the missing-both anchor 1.	2 / 3
Trigger Term Quality	Contains relevant terms ("SSRF", "code execution") but leans on jargon ("pivot chains", "metadata/infra control") and misses common natural variations a user would say, matching anchor 2 rather than the broad coverage of anchor 3 or the no-natural-keywords anchor 1.	2 / 3
Distinctiveness Conflict Risk	Targets a clear niche (SSRF-to-RCE chaining toward cloud metadata) with distinct triggers unlikely to overlap with other skills, matching anchor 3; it is far more specific than the generic/overlapping anchor 1 and 2 examples.	3 / 3
	Total	9 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/analyst/chains/ssrf-to-rce/SKILL.md
Commit: e34afba

Reviewed: about 15 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.