crypto

Web crypto exploitation — padding-oracle (Vaudenay), AES-CBC bit-flipping / IV manipulation, AES-ECB pattern attacks (cut-and-paste, prefix/suffix recovery), HMAC bypass, hash-length extension, JWT alg confusion. Covers detection signals, working in-file Python harnesses (concurrent.futures, timeout=5, python3 -u, bounded request budget), and the confirm-oracle gate that must fire before iteration.

Quality

72%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/exploit/web/crypto/SKILL.md

Quality

Content

77%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable and exceptionally well-sequenced with explicit validation gates and error-recovery feedback loops, but it is a long single-file skill that underuses progressive disclosure (no reference files) and carries some verbosity in the inline mega-harness and repeated rationale.

Suggestions

Move the full Vaudenay padding-oracle harness and the JWT/HMAC detail blocks into reference files (e.g. references/padding_oracle.py, references/jwt_forge.py) and keep SKILL.md as a concise overview with one-level-deep links to lift progressive_disclosure toward 3.

Tighten the repeated operational rationale (request-budget arithmetic, max_workers justification appears in both the harness comments and Anti-Patterns) to a single concise statement to improve conciseness.

Keep at least the confirm-oracle gate and recognition signals inline as the 'overview' so the lean top of SKILL.md stays actionable while the large scripts offload.

Dimension	Reasoning	Score
Conciseness	The body is operational and mostly free of concept filler, but at ~290 lines it reproduces a large inline Vaudenay harness and repeats operational rationale (budget arithmetic, max_workers justification) that could be tightened, landing at 'mostly efficient but could be tightened' rather than the lean 3 anchor.	2 / 3
Actionability	Provides fully executable Python and bash throughout (the Vaudenay harness with concurrent.futures and budget tracking, the confirm-oracle gate probe, JWT forge snippet, ECB and bit-flip snippets, hashpump command), copy-paste ready with clearly marked placeholders.	3 / 3
Workflow Clarity	Clearly sequenced with Step 0 key-discovery first, an explicit STOP confirm-oracle gate with pass/fail criteria, branch-on-fail hand-back, first-block verification kill/revisit loops, and a Verification section with per-attack success criteria — explicit validation steps and feedback loops.	3 / 3
Progressive Disclosure	No bundle files (references/scripts/assets) exist and the entire skill is inline in SKILL.md; sectioning is good but large inline harnesses and per-attack detail that could be split into reference files stay inline, matching 'some structure but content that should be separate is inline'.	2 / 3
	Total	10 / 12 Passed

Description

67%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is highly specific and clearly niche-scoped with concrete attack actions, but it leans technical-algorithmic and omits an explicit 'Use when...' trigger clause, pushing the natural-language trigger phrasings into the separate when_to_use field rather than the description itself.

Suggestions

Append an explicit 'Use when...' clause to the description (e.g. 'Use when working with encrypted/base64 cookies, JWTs, or CTF crypto challenges') so the trigger guidance lives in the description and completeness can reach 3.

Surface the everyday user phrasings currently only in when_to_use ('encrypted cookie', 'base64 cookie', 'encrypted captcha') into the description to improve trigger_term_quality.

Trim a couple of the more jargon-heavy parentheticals to keep the description readable without losing the concrete attack enumeration.

Dimension	Reasoning	Score
Specificity	Lists many concrete attack actions (padding-oracle/Vaudenay, AES-CBC bit-flipping, AES-ECB cut-and-paste, HMAC bypass, hash-length extension, JWT alg confusion) plus operational specifics (concurrent.futures, timeout=5, bounded budget), matching the 'lists multiple specific concrete actions' anchor.	3 / 3
Completeness	Clearly answers 'what' with a long enumeration of attacks, but the description has no explicit 'Use when...' trigger clause (that guidance lives in when_to_use), capping completeness at 2 per the missing-trigger guideline.	2 / 3
Trigger Term Quality	Strong crypto-attack keywords are present (padding-oracle, AES-CBC, AES-ECB, HMAC bypass, JWT alg confusion) but the most colloquial user phrasings ('encrypted cookie', 'encrypted captcha', 'base64 cookie') sit in when_to_use rather than the description, leaving it at 'some relevant keywords but missing common variations'.	2 / 3
Distinctiveness Conflict Risk	The niche is sharply defined (web crypto exploitation with named attack primitives like Vaudenay padding oracle and hash-length extension), making it unlikely to trigger for unrelated skills.	3 / 3
	Total	10 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/exploit/web/crypto/SKILL.md
Commit: e34afba

Reviewed: about 15 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.