crypto

Web crypto exploitation — padding-oracle (Vaudenay), AES-CBC bit-flipping / IV manipulation, AES-ECB pattern attacks (cut-and-paste, prefix/suffix recovery), HMAC bypass, hash-length extension, JWT alg confusion. Covers detection signals, working in-file Python harnesses (concurrent.futures, timeout=5, python3 -u, bounded request budget), and the confirm-oracle gate that must fire before iteration.

Quality

83%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

85%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

An exceptionally actionable, well-sequenced skill body with strong validation checkpoints, held back only by mild over-explanation and a monolithic single-file structure with no progressive disclosure into bundle files.

Suggestions

Split the long runnable harnesses into scripts/ files (e.g. scripts/padding_oracle.py, scripts/jwt_forge.py) and reference them one level deep from SKILL.md, keeping only the gate and key-discovery probes inline — this would lift progressive_disclosure without sacrificing the atomic-pipeline discipline.

Tighten the explanatory prose in sections 2 and 3 (CBC bit-flip block-corruption note, ECB identical-block reminder) to assumptions Claude already holds, trimming toward the lean anchor.

Move the per-attack verification criteria currently in the 'Verification' section into a short checklist format so the validation feedback loops are scannable rather than prose.

Dimension	Reasoning	Score
Conciseness	The body is dense and mostly operational with minimal concept padding, but a few explanatory sentences restate mechanics Claude already knows (e.g. the CBC bit-flip block-corruption explanation and the ECB identical-block reminder) and could be trimmed.	4 / 5
Actionability	Provides fully executable, copy-paste-ready harnesses — the complete Vaudenay padding-oracle script, bit-flip snippet, ECB detection, JWT HS256-confusion forge, and hashpump command — with concrete `timeout 600 python3 -u -c` invocation patterns covering the common cases.	5 / 5
Workflow Clarity	Clear sequence (Step 0 key discovery → recognition → confirm-oracle gate → attacks → verification → output files) with an explicit validation checkpoint (the gate with pass/fail criteria) and feedback loops (gate fail → recon; first-block garbage → KILL and re-derive), which is exactly what the batch oracle workflow requires.	5 / 5
Progressive Disclosure	Well-organized into clear section headers, but it is a single ~320-line monolithic file with no bundle files (references/scripts/assets absent) and no one-level-deep external references, so content that could be split (full harnesses, JWT forge code) is inlined.	3 / 5
	Total	17 / 20 Passed

Description

82%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A highly specific, distinctive description with strong trigger-term coverage, weakened only by the absence of an explicit in-description 'Use when...' trigger clause (triggers are instead relegated to metadata.when_to_use).

Suggestions

Add an explicit 'Use when ...' clause inside the description field (e.g. 'Use when a challenge involves encrypted cookies, padding oracles, CBC/ECB ciphertext manipulation, JWT alg confusion, or hash-length extension') so the 'when' guidance lives in the description itself rather than only in metadata.when_to_use.

Consider surfacing 2-3 of the most natural user phrasings (e.g. 'padding oracle', 'encrypted cookie', 'JWT none') directly in the description sentence to raise the explicit-trigger bar above the cap of 3.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete attack actions — 'padding-oracle (Vaudenay)', 'AES-CBC bit-flipping / IV manipulation', 'AES-ECB pattern attacks (cut-and-paste, prefix/suffix recovery)', 'HMAC bypass', 'hash-length extension', 'JWT alg confusion' — plus detection signals and harness discipline, giving comprehensive coverage.	5 / 5
Completeness	The 'what' is explicit and detailed, but the description lacks a 'Use when...' clause or equivalent explicit trigger guidance (the trigger terms live in a separate metadata.when_to_use field, not the description), so completeness is capped at 3 per the rubric guideline.	3 / 5
Trigger Term Quality	Includes the natural keywords a CTF user would say — 'padding-oracle', 'AES-CBC', 'AES-ECB', 'HMAC bypass', 'hash-length extension', 'JWT alg confusion' — alongside synonyms like 'cut-and-paste' and 'bit-flipping'.	5 / 5
Distinctiveness Conflict Risk	'Web crypto exploitation' scoped to specific attack primitives (Vaudenay padding oracle, ECB cut-and-paste, JWT alg confusion, hash-length extension) carves a clear niche with minimal overlap against other skills.	5 / 5
	Total	18 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/exploit/web/crypto/SKILL.md
Commit: 0cf691e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.