CtrlK
BlogDocsLog inGet started
Tessl Logo

decepticon

Drive Decepticon — an autonomous multi-agent red-team framework — over MCP to run authorized penetration tests and bug-bounty engagements end to end, then watch and steer them live from chat. Launch an engagement against a target, poll its transcript to narrate progress, send messages to refocus it, and pull findings as SARIF. Use when the user asks to run a pentest/red-team engagement, hunt a bug bounty, do recon, exploit/scan a host, web app, API, network, cloud, Active Directory, mobile app, or smart contract WITH Decepticon — or to check/resume a running engagement or report what Decepticon found. Triggers: run a decepticon engagement, pentest this with decepticon, bug bounty, recon this target, red team this, scan this host, resume the engagement, what did decepticon find, decepticon status. Do NOT use for ad-hoc local tool runs (running nmap/sqlmap/ffuf directly) when no Decepticon server is involved — this drives the Decepticon orchestrator, not raw tools.

68

Quality

85%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

71%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-organized, actionable operator guide with a clear core loop and validation for a destructive workflow, held back by references to reference.md and examples.md that are not present in the bundle. Conciseness and actionability are strong; progressive disclosure is the weakest dimension due to the missing bundle files.

Suggestions

Ship the referenced reference.md and examples.md (or move the essential parameter schemas and one worked run inline) so the body's links resolve and the skill is self-contained.

Tighten the 'Mental model' and 'Authorization' sections, which overlap with the description and the core loop, to reclaim tokens.

Add a concise validate→fix→retry loop for the error/timeout case (e.g., read cause → send_message a targeted fix → re-check status) to push workflow clarity to 5.

DimensionReasoningScore

Conciseness

Largely lean and operator-focused — it does not explain what pentesting or nmap is and every section earns its place — but the mental-model and authorization sections lightly restate information already conveyed elsewhere and could be tightened slightly.

4 / 5

Actionability

Concrete, executable guidance throughout: a full tools table with key args and return fields, and real call shapes like 'decepticon_start_engagement(targets=[…], instruction="In scope: …; Out of scope: …", scan_mode="standard")' and 'decepticon_send_message(thread_id, "skip the staging host, focus on the API")'. Minor gaps because full parameter schemas and worked runs are deferred to reference.md/examples.md.

4 / 5

Workflow Clarity

The six-step 'core loop' is a clear numbered sequence with explicit checkpoints ('stop polling when status is terminal or findings_available is true') and an errors-and-recovery section providing feedback loops; the non-negotiable authorization step supplies the validation a destructive skill requires, so the destructive-cap does not apply. Falls just short of 5 because recovery is 'offer to fix or start fresh' rather than a tight validate→fix→retry loop.

4 / 5

Progressive Disclosure

The body is well structured as an overview with clearly signaled one-level references to '[reference.md](reference.md)' and '[examples.md](examples.md)', but those referenced files do not exist in the bundle (no references/ directory), so the disclosure promise is unfulfilled and navigation breaks — more than a minor organization gap.

3 / 5

Total

15

/

20

Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that concretely states capabilities, provides comprehensive natural trigger terms, answers both what and when, and draws a clear boundary against adjacent raw-tool skills. Nothing notable to improve.

DimensionReasoningScore

Specificity

Lists multiple concrete actions — 'run authorized penetration tests and bug-bounty engagements end to end', 'watch and steer them live', 'poll its transcript to narrate progress', 'send messages to refocus it', 'pull findings as SARIF' — with comprehensive coverage of the operator workflow.

5 / 5

Completeness

Explicitly answers both what (drive Decepticon over MCP to run/watch/steer/report engagements) and when ('Use when the user asks to...') with concrete trigger phrases, exceeding the 5-anchor bar.

5 / 5

Trigger Term Quality

Comprehensive natural trigger coverage including synonyms ('pentest/red-team engagement', 'hunt a bug bounty', 'do recon', 'exploit/scan a host') plus an explicit 'Triggers:' list with user-natural phrases like 'resume the engagement' and 'what did decepticon find'.

5 / 5

Distinctiveness Conflict Risk

Clear niche tied to the Decepticon orchestrator over MCP with name-anchored triggers, and an explicit 'Do NOT use for ad-hoc local tool runs' boundary that minimizes conflict with raw-tool skills.

5 / 5

Total

20

/

20

Passed

Validation

75%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation12 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

metadata_field

'metadata' should map string keys to string values

Warning

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

relative_links

Relative link issues: 4 missing

Warning

Total

12

/

16

Passed

Repository
PurpleAILAB/Decepticon
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.