command-injection

Hunt OS command injection (CWE-78) — user input reaching shell, exec, or system calls. Covers argument-array bypasses, path confusion, and template-string injection in modern frameworks.

Quality

80%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/analyst/command-injection/SKILL.md

Quality

Content

90%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A lean, highly actionable playbook with executable grep/PoC commands and a clear three-level audit workflow plus a validation contract; the main improvement is splitting the longer reference-style sections into bundle files.

Suggestions

Move the bypass catalog (Section 4) and the default CVSS table (Section 7) into references/ files (e.g., BYPASSES.md, CVSS.md) and link to them from the body to improve progressive disclosure.

Add an explicit feedback loop after the validate_finding contract — 'If success_patterns absent, adjust payload and re-run' — to push workflow_clarity to 5.

Add a one-line pointer at the top of the audit workflow noting that Level 1 results feed Level 2/3 sweeps, making the sequencing between levels explicit.

Dimension	Reasoning	Score
Conciseness	The body is dense and lean — compact dangerous/safer API tables, grep one-liners, and concrete bypass lines with no padding or explanation of concepts Claude already knows; even the opening analogy is two lines and earns its place as orientation.	5 / 5
Actionability	Everything is copy-paste executable: language-specific sink tables, three-level grep audit commands, named bypass techniques with payload strings, and ready-to-run curl PoCs covering blind, OOB, and noisy confirmation cases.	5 / 5
Workflow Clarity	The audit workflow is explicitly sequenced (Level 1/2/3 grep sweeps) and a validate_finding contract with success/negative patterns provides a verification checkpoint, but there is no explicit 'validate -> fix -> retry' feedback loop, so it sits just below 5.	4 / 5
Progressive Disclosure	The body is cleanly organized into eight numbered sections with no nested or buried references, but at ~94 lines as a single monolithic file it could offload the bypass catalog or CVSS tables into reference files to reach the well-split 5 anchor.	4 / 5
	Total	18 / 20 Passed

Description

70%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A specific, well-targeted description that clearly names the niche and concrete bypass categories, but it omits an explicit 'Use when...' trigger clause, capping completeness at 3.

Suggestions

Add an explicit 'Use when...' clause to the description (e.g., 'Use when auditing code for command injection, shell injection, or RCE via user input reaching shell/exec calls') to lift completeness.

Include common synonyms users actually say — 'shell injection' and 'RCE' — alongside 'command injection' to broaden trigger-term coverage.

Repeat 1-2 of the strongest trigger terms from metadata.when_to_use directly in the description so the when-guidance is visible without relying on metadata.

Dimension	Reasoning	Score
Specificity	The description names the domain ('Hunt OS command injection (CWE-78)') and lists several concrete coverage areas — 'argument-array bypasses, path confusion, and template-string injection' — but the single verb 'Hunt' and 'Covers...' leave minor gaps versus the comprehensive multi-action anchor at 5.	4 / 5
Completeness	The 'what' is clearly stated ('Hunt OS command injection... Covers...'), but there is no explicit 'Use when...' clause or equivalent trigger guidance in the description — the when-guidance lives only in metadata, so per the rubric completeness is capped at 3.	3 / 5
Trigger Term Quality	Strong technical keywords appear ('OS command injection', 'CWE-78', 'shell, exec, or system calls', 'template-string injection'), and 'command injection' is a natural user phrase, but common synonyms like 'shell injection' and 'RCE' are absent.	4 / 5
Distinctiveness Conflict Risk	'Hunt OS command injection (CWE-78)' carves out a clear, narrow niche with distinct triggers and minimal overlap risk against other skills.	5 / 5
	Total	16 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/analyst/command-injection/SKILL.md
Commit: 0cf691e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.