credential-access

Credential extraction and capture — LSASS dumping, SAM/SECURITY hive extraction, DPAPI decryption, NTLM relay, Responder poisoning, password spraying, hash cracking.

Quality

66%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/post-exploit/credential-access/SKILL.md

Quality

Content

65%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a highly actionable credential-access reference rich in executable commands and tables, with strong actionability and a clear decision gate. Its weaknesses are verbosity and duplication in the main body, missing validation feedback loops for destructive operations, and underuse of progressive disclosure despite a valid bundled reference.

Suggestions

Remove the duplicated Quick Reference commands or convert it into a pure pointer to the relevant sections to reduce redundancy and lift conciseness.

Add explicit validation/verification checkpoints for destructive and batch operations (e.g., confirm a dump parses with pypykatz before moving on; verify spray attempts stay below lockout threshold and re-check policy mid-run) to reach a 3 on workflow clarity.

Split the large inline sections (techniques 1-7, Detection Signatures, Tools & Resources) into additional reference files and present SKILL.md as a concise overview with one-level-deep links to improve progressive disclosure.

Dimension	Reasoning	Score
Conciseness	The ~370-line body is dense with executable commands rather than concept explanations Claude already knows, but the Quick Reference duplicates commands that reappear in the detailed sections (e.g., comsvcs.dll, reg save), so it is mostly efficient yet could be tightened; not a 3 due to redundancy and length.	2 / 3
Actionability	It provides fully executable, copy-paste-ready commands with real flags and placeholders (e.g., 'hashcat -m 1000 ... -r .../best64.rule', 'secretsdump.py ... -just-dc-ntlm'), matching the anchor for specific, concrete, executable examples.	3 / 3
Workflow Clarity	Sections are organized by technique and include a Decision Gate with branching next steps plus a lockout-awareness rule, but for destructive/batch operations like LSASS dumping and spraying there are no explicit validation checkpoints or validate->fix->retry feedback loops, which caps workflow clarity at 2.	2 / 3
Progressive Disclosure	The single bundled reference references/lsass-techniques.md exists and is well signaled one level deep, but the SKILL.md body is a large monolithic wall keeping nearly all detail inline rather than serving as a concise overview pointing to multiple reference files, fitting the 'content that should be separate is inline' anchor.	2 / 3
	Total	9 / 12 Passed

Description

67%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and clearly distinct within the offensive-security domain, listing concrete credential-access techniques. Its main weakness is the absence of an explicit 'when to use' trigger clause, which limits completeness and natural trigger-term coverage.

Suggestions

Add an explicit 'Use when ...' clause naming natural user phrasings (e.g., 'Use when dumping credentials, capturing NTLM hashes, spraying passwords, or cracking hashes') to satisfy the completeness dimension.

Broaden trigger terms toward everyday phrasing users would actually say (e.g., 'dump passwords', 'crack hashes', 'capture hashes') alongside the current technique jargon to lift trigger-term quality to 3.

Consider trimming the long em-dash list or grouping it so the description reads as a capability statement plus a trigger clause rather than a flat technique catalog.

Dimension	Reasoning	Score
Specificity	The description enumerates multiple concrete credential-access actions: 'LSASS dumping, SAM/SECURITY hive extraction, DPAPI decryption, NTLM relay, Responder poisoning, password spraying, hash cracking', matching the anchor for listing several specific concrete actions.	3 / 3
Completeness	It clearly answers 'what does this do' with specific actions, but there is no 'Use when...' clause or equivalent explicit trigger guidance for when Claude should invoke it, which per the guidelines caps completeness at 2.	2 / 3
Trigger Term Quality	It includes some natural terms users would say ('password spraying', 'hash cracking', 'NTLM relay', 'LSASS'), but the list leans toward tool/technique jargon ('DPAPI decryption', 'Responder poisoning') and misses common phrasing variations, so it does not reach the broad natural-term coverage of a 3.	2 / 3
Distinctiveness Conflict Risk	The credential-extraction framing with unmistakable triggers (LSASS dumping, DPAPI, NTLM relay, hash cracking) carves a clear niche that is unlikely to fire for unrelated skills.	3 / 3
	Total	10 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/post-exploit/credential-access/SKILL.md
Commit: e34afba

Reviewed: about 14 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.