defense-evasion

Endpoint defense bypass — AMSI/ETW patching, ScareCrow framework, custom loaders, direct/indirect syscalls, LOLBAS execution, process injection.

Quality

73%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/shared/defense-evasion/SKILL.md

Quality

Content

71%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The skill is a thorough, actionable evasion reference with strong code coverage and a useful decision-gate/checklist, but it is over-inlined for progressive disclosure and only half its bundled references are surfaced.

Suggestions

Move the large code catalogs (full Nim/Rust/Go loaders, per-binary LOLBAS examples) into references/ and keep only a representative example plus a link in SKILL.md to reduce the inline wall of text.

Surface the existing 'references/modern-evasion-techniques.md' in the Bundled Resources section so both reference files are discoverable, and signal each reference with a 'Read when...' trigger.

Add an explicit validate->fix->retry loop (e.g., test payload against target AV/EDR, if flagged adjust technique and re-test) to satisfy the destructive-operation feedback-loop guidance.

Dimension	Reasoning	Score
Conciseness	Dense reference of tables and executable code with little concept padding, assuming Claude's competence; a few prose intros and repeated OPSEC tables could be trimmed further, keeping it just below anchor 5.	4 / 5
Actionability	Extensive copy-paste-ready code across PowerShell, C#, Nim, Rust, and Go plus concrete ScareCrow/SysWhispers commands; placeholders like '<ENCRYPTED_SHELLCODE_BYTES>' and '<C2_HOST>' are minor gaps that keep it from anchor 5.	4 / 5
Workflow Clarity	A decision gate and pre-execution checklist provide sequencing and checkpoints for destructive operations, but there is no explicit validate->fix->retry feedback loop, which the rubric's destructive-operation guidance flags as a cap risk; the checklist mitigates it to 4.	4 / 5
Progressive Disclosure	The body is a ~490-line monolith with most detailed content inlined; only one of two reference files is surfaced in the body and 'modern-evasion-techniques.md' is unreferenced, fitting anchor 3 where content that should be separate stays inline.	3 / 5
	Total	15 / 20 Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and well-differentiated with strong trigger keywords, but it omits an explicit 'Use when...' clause, capping completeness. Pulling the when_to_use guidance into the description would make it fully self-contained.

Suggestions

Add an explicit 'Use when...' clause to the description (e.g., 'Use when bypassing AMSI/ETW, evading EDR, generating evasive loaders, or executing via LOLBAS') so the when-guidance is not buried only in metadata.

Add common synonyms or file extensions (e.g., 'AV bypass', '.exe loaders') to broaden natural trigger-term coverage.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete capabilities — 'AMSI/ETW patching, ScareCrow framework, custom loaders, direct/indirect syscalls, LOLBAS execution, process injection' — giving comprehensive coverage of specific actions.	5 / 5
Completeness	Has a clear 'what' but no explicit 'Use when...' clause in the description itself; trigger guidance lives only in metadata, so per the missing-trigger-clause rule completeness caps at 3.	3 / 5
Trigger Term Quality	Strong natural keyword coverage (AMSI, ETW, ScareCrow, loader, syscall, LOLBAS, injection), but lacks common synonyms and file extensions that would push it to anchor 5.	4 / 5
Distinctiveness Conflict Risk	Niche-specific terms (AMSI/ETW/ScareCrow/LOLBAS/syscalls) form a clear, distinct trigger set with minimal overlap risk against unrelated skills.	5 / 5
	Total	17 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
relative_links	Relative link issues: 2 missing	Warning

	Total	14 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/shared/defense-evasion/SKILL.md
Commit: 0cf691e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.