CtrlK
BlogDocsLog inGet started
Tessl Logo

decepticon

Drive Decepticon — an autonomous multi-agent red-team framework — over MCP to run authorized penetration tests and bug-bounty engagements end to end, then watch and steer them live from chat. Launch an engagement against a target, poll its transcript to narrate progress, send messages to refocus it, and pull findings as SARIF. Use when the user asks to run a pentest/red-team engagement, hunt a bug bounty, do recon, exploit/scan a host, web app, API, network, cloud, Active Directory, mobile app, or smart contract WITH Decepticon — or to check/resume a running engagement or report what Decepticon found. Triggers: run a decepticon engagement, pentest this with decepticon, bug bounty, recon this target, red team this, scan this host, resume the engagement, what did decepticon find, decepticon status. Do NOT use for ad-hoc local tool runs (running nmap/sqlmap/ffuf directly) when no Decepticon server is involved — this drives the Decepticon orchestrator, not raw tools.

75

Quality

96%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

92%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A tight, highly actionable MCP-orchestration skill body with a sequenced core loop, polling-cadence guidance, and error-recovery feedback loops. Its only material weakness is progressive disclosure: the referenced reference.md and examples.md files are not present in the bundle.

Suggestions

Ship the referenced reference.md and examples.md files (or remove the links) so the progressive-disclosure path resolves to real files.

Consolidate the three repeated pointers to reference.md/examples.md (Tools section, end of the core loop, and closing line) into a single 'For depth' section to trim redundancy.

Add one fully concrete start example with realistic scope strings instead of '…' placeholders so the launch step is copy-paste ready.

DimensionReasoningScore

Conciseness

Lean operational guidance that assumes Claude's competence — it does not explain what red-teaming, MCP, or SARIF are, and each section (mental model, tools, core loop, cadence, interpreting results, errors) earns its place without padding.

3 / 3

Actionability

Concrete and executable for an MCP skill: the tool table gives exact tool names, args, and return fields, and the core loop shows specific calls such as decepticon_start_engagement(targets=[…], instruction="In scope: …; Out of scope: …", scan_mode="standard") and decepticon_send_message(thread_id, "skip the staging host, focus on the API").

3 / 3

Workflow Clarity

A clear 6-step core loop with explicit checkpoints ('stop polling when status is terminal or findings_available is true') and an errors-and-recovery section providing feedback loops (status=error → read transcript → offer fix or restart).

3 / 3

Progressive Disclosure

The body is well structured as an overview and defers detail to clearly signaled one-level-deep links ([reference.md](reference.md), [examples.md](examples.md)), but neither referenced file exists in the bundle, so the disclosure path is broken rather than functional.

2 / 3

Total

11

/

12

Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, well-constructed description: concrete actions, an explicit 'Use when' clause plus a natural-language trigger list, and a conflict-reducing exclusion clause. It clearly answers what to do, when to use it, and how it differs from adjacent skills.

DimensionReasoningScore

Specificity

Lists multiple concrete actions — 'Launch an engagement against a target, poll its transcript to narrate progress, send messages to refocus it, and pull findings as SARIF' — rather than vague language.

3 / 3

Completeness

Explicitly answers both what (drive Decepticon over MCP end to end) and when, with an explicit 'Use when...' clause and a 'Triggers:' list rather than mere implication.

3 / 3

Trigger Term Quality

Includes natural phrases users would say via the 'Triggers:' list ('pentest this with decepticon, bug bounty, recon this target, red team this, scan this host'); imperative/third-person voice matches the reference examples with no penalized 'I can help'/'You can use this' phrasing.

3 / 3

Distinctiveness Conflict Risk

Occupies a clear niche (the Decepticon orchestrator over MCP) and adds a 'Do NOT use for ad-hoc local tool runs' exclusion clause, reducing conflict with raw-tool skills.

3 / 3

Total

12

/

12

Passed

Validation

75%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation12 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

metadata_field

'metadata' should map string keys to string values

Warning

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

relative_links

Relative link issues: 4 missing

Warning

Total

12

/

16

Passed

Repository
PurpleAILAB/Decepticon
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.