deauth-pmf

Targeted and broadcast 802.11 deauthentication / disassociation, 802.11w/PMF posture detection, and action-frame attack variants. Reusable by wpa2-psk (handshake), wpa3-sae (downgrade), and evil-twin (roaming coercion).

Quality

80%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/wireless/deauth-pmf/SKILL.md

Quality

Content

92%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable, lean, and sequenced with strong validation checkpoints for destructive wireless operations, but it is monolithic with no progressive disclosure into bundle files despite being long enough to benefit from splitting.

Suggestions

Move the mdk4 flood variants (Step 4) and the scapy action-frame script (Step 5) into a separate reference file such as references/advanced-attacks.md, linking from the body so SKILL.md stays focused on the core PMF-detection and deauth flow.

Add a brief 'Quick path' summary near the top mapping common objectives to steps (handshake capture → Step 2, DoS testing → Steps 3–4) so callers can navigate without reading the whole file.

Dimension	Reasoning	Score
Conciseness	The body is lean and assumes Claude's competence — it never explains what 802.11 or deauth is conceptually — and prose (OPSEC notes, interpretation comments) earns its place with domain-specific detail, matching the 'lean and efficient; every token earns its place' anchor.	3 / 3
Actionability	Provides fully executable, copy-paste-ready commands (airodump-ng, aireplay-ng, mdk4, tshark) plus a real scapy script and a real kg_add_node evidence call, with placeholders clearly justified — matching the 'fully executable code/commands' anchor.	3 / 3
Workflow Clarity	Steps are clearly sequenced (PMF detection → decision table → targeted deauth → broadcast → mdk4 → action-frame) with explicit checkpoints: the PMF-state decision table gates progression, a 'HARD STOP' RoE gate precedes broadcast deauth, and the ZFP section lists verification artifacts — satisfying the validation requirement for destructive/batch operations.	3 / 3
Progressive Disclosure	The skill is well-organized into sections but is a monolithic ~230-line file with no bundle files (references/scripts/assets absent), so content that could be split out — the mdk4 flood variants and the scapy action-frame script — is inline; this matches the 'some structure but content that should be separate is inline' anchor rather than level 3.	2 / 3
	Total	11 / 12 Passed

Description

67%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and occupies a clear, well-differentiated niche, but it relies on technical jargon for triggers and lacks an explicit 'Use when...' clause, leaving the 'when to use' guidance only implied.

Suggestions

Add an explicit 'Use when...' clause naming concrete triggers, e.g. 'Use when the user needs to disconnect WiFi clients for handshake capture, detect 802.11w/PMF posture, or test deauth/DoS resilience'.

Add plain-language trigger variants alongside the jargon (e.g. 'kick off / disconnect WiFi clients', 'WiFi deauth') so non-specialist phrasing still routes to this skill.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'Targeted and broadcast 802.11 deauthentication / disassociation, 802.11w/PMF posture detection, and action-frame attack variants' — matching the rubric's 'lists multiple specific concrete actions' anchor rather than the partial level 2.	3 / 3
Completeness	The 'what' is clearly stated, but the 'when' is only implied via 'Reusable by wpa2-psk ... wpa3-sae ... evil-twin' with no explicit 'Use when...' trigger clause, which per the guidelines caps completeness at 2.	2 / 3
Trigger Term Quality	Uses solid domain-standard terms ('deauthentication / disassociation', '802.11w/PMF') that a specialist would say, but they lean technical jargon and lack plain-language variations like 'disconnect WiFi clients'; not the full coverage of level 3.	2 / 3
Distinctiveness Conflict Risk	The 802.11 deauth/PMF niche is clearly distinct, and it explicitly differentiates itself from sibling caller skills (wpa2-psk, wpa3-sae, evil-twin), making conflict with the wrong skill unlikely.	3 / 3
	Total	10 / 12 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
metadata_field	'metadata' should map string keys to string values	Warning

	Total	14 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/wireless/deauth-pmf/SKILL.md
Commit: e34afba

Reviewed: about 14 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.