CtrlK
BlogDocsLog inGet started
Tessl Logo

chain-xss-to-takeover

Build chains from XSS into account takeover or privileged action execution.

52

Quality

59%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/analyst/chains/xss-to-takeover/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

65%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is admirably concise and well-structured for a simple chaining skill, but its steps are abstract directives rather than concrete, executable guidance, and validation is not expressed as an explicit checkpoint. Tightening actionability and the validation loop would most improve it.

Suggestions

Add concrete, executable guidance for each step — example payloads or selectors for session/CSRF token extraction and the privileged-action fetch, so steps are copy-paste actionable rather than descriptive.

Turn the Validation section into an explicit checkpoint with a feedback loop, e.g. '4. Validate: confirm both browser-side document.cookie / fetch evidence AND a server-side action log; if either is missing, return to step 1/2.'

Optionally include a minimal worked example (e.g. a payload skeleton) inline to cover the common cases and lift actionability.

DimensionReasoningScore

Conciseness

The body is a lean 10 lines with no padding and no explanation of concepts Claude already knows; every line earns its place and assumes Claude's competence.

5 / 5

Actionability

Steps are high-level directives ("Steal session/CSRF token or trigger privileged action", "Demonstrate durable account impact") with no concrete payload, code, command, or selector — it describes the chain rather than giving executable guidance, matching the minimal-guidance anchor.

2 / 5

Workflow Clarity

A clear four-step canonical path exists and a Validation section is present, but validation is a single implicit directive rather than an explicit checkpoint with a fix-and-retry feedback loop; for destructive/privileged-action work this lands at the anchor with validation gaps.

3 / 5

Progressive Disclosure

The skill is well under 50 lines, single-purpose, with clean section headers and no need for external references; the simple-skill exception lets progressive disclosure score 5 on well-organized sections alone.

5 / 5

Total

15

/

20

Passed

Description

53%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description states a clear purpose and distinct niche but lacks an explicit usage-trigger clause and relegates natural trigger keywords to metadata, leaving both completeness and trigger-term quality capped. It is functional but not maximally activating.

Suggestions

Add an explicit 'Use when...' clause, e.g. 'Use when exploiting XSS to chain into account takeover — cookie/session theft, CSRF token capture, or privileged action execution.'

Move the natural trigger keywords currently in when_to_use metadata (cookie, session, CSRF token, post-message) into the description itself so they drive activation.

Name the concrete chain primitives (session stealing, CSRF token theft, postMessage abuse) in the description to raise specificity above 3.

DimensionReasoningScore

Specificity

"Build chains from XSS into account takeover or privileged action execution" names the domain and a concrete action plus two outcomes, but coverage is moderate rather than comprehensive — it omits the specific theft primitives (cookie/session/CSRF token) that appear only in metadata.

3 / 5

Completeness

It clearly answers "what" (build XSS chains into takeover/privileged actions) but provides no explicit "Use when..." trigger clause; per the rubric a missing when-clause caps completeness at 3.

3 / 5

Trigger Term Quality

The description surfaces "XSS", "account takeover", and "privileged action", but the natural trigger phrases a user would actually say (cookie, session, CSRF token, post-message) live only in the when_to_use metadata, not the description itself, so common variations are missing.

3 / 5

Distinctiveness Conflict Risk

"XSS to account takeover" is a narrow, distinct niche with little overlap risk against general web-exploitation skills; only minor overlap with adjacent CSRF/session skills keeps it just below 5.

4 / 5

Total

13

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

Total

15

/

16

Passed

Repository
PurpleAILAB/Decepticon
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.