edge-device-exploitation

Edge device exploitation — routers, firewalls, VPN appliances (Cisco IOS XE, Fortinet, Ivanti, Palo Alto). Covers CVE exploitation chains, post-exploitation on network devices, config extraction, and implant deployment on perimeter infrastructure.

Quality

77%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/exploit/edge-device-exploitation/SKILL.md

Quality

Content

80%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A dense, executable, token-efficient reference whose commands and CVE chains are highly actionable. Its weaknesses are the absence of validation feedback loops for destructive operations and a monolithic structure with no bundle/reference split.

Suggestions

Add explicit validation checkpoints after destructive steps (e.g. verify the implant account exists, confirm config was exfiltrated intact, validate the EEM applet took effect) with a fix-and-retry loop.

Split per-CVE deep dives into separate reference files (e.g. references/cve-2023-20198.md) and keep SKILL.md as an overview with one-level-deep links, improving progressive disclosure.

Dimension	Reasoning	Score
Conciseness	Lean and command-driven with terse inline comments; it assumes Claude's competence and avoids explaining what routers, SNMP, or CVEs are, so every token earns its place.	5 / 5
Actionability	Copy-paste-ready curl/nmap/snmp/ssh commands with specific endpoints, headers, and CVE-specific payloads cover the common cases fully and executably.	5 / 5
Workflow Clarity	Per-CVE step sequences and a decision gate give a clear sequence, but destructive/batch operations (implant deployment, config exfiltration, persistence) lack explicit validation/verification checkpoints, so workflow clarity is capped at 3 per the rubric.	3 / 5
Progressive Disclosure	The skill is a single ~310-line monolithic SKILL.md with no bundle files; it inlines per-CVE deep dives and tools/detection tables that could be split into reference files, so structure is present but not appropriately separated into one-level-deep references.	3 / 5
	Total	16 / 20 Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A specific, well-scoped description that names concrete capabilities and vendor/CVE triggers, giving it strong distinctiveness and specificity. Its main weakness is the absence of an explicit 'Use when...' trigger clause, which caps completeness.

Suggestions

Add an explicit trigger clause such as 'Use when assessing or exploiting perimeter network appliances — routers, firewalls, or VPN concentrators — or when the user names edge-device CVEs.'

Surface a couple of common user phrasings (e.g. 'compromise edge device', 'breach firewall') to round out trigger-term coverage.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'CVE exploitation chains', 'post-exploitation on network devices', 'config extraction', 'implant deployment' — alongside named vendors/devices (Cisco IOS XE, Fortinet, Ivanti, Palo Alto), giving comprehensive coverage.	5 / 5
Completeness	The 'what' is clearly enumerated, but there is no explicit 'Use when...' trigger clause; per the judging guidelines, a missing explicit trigger caps completeness at 3.	3 / 5
Trigger Term Quality	Strong natural keywords (routers, firewalls, VPN, FortiGate, PAN-OS, and specific CVE IDs), but a few common user phrasings like 'compromise' or file-style cues are absent, keeping it just below the comprehensive anchor.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (perimeter network appliances) with distinct, vendor/CVE-specific triggers that make overlap with unrelated skills minimal.	5 / 5
	Total	17 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/exploit/edge-device-exploitation/SKILL.md
Commit: 0cf691e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.