emulation-overview

Adversary-emulation playbook catalog — per-actor kill chains that turn an APT/eCrime threat profile into Decepticon CONOPS phases + OPPLAN objectives. Routing skill: pick the actor, seed plan/threat-profile.json, then map each kill-chain phase to the operational skill the executing agent runs. Triggers on: 'emulate', 'adversary emulation', 'APT playbook', 'threat actor playbook', 'emulation plan', 'attack flow'.

Quality

81%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

75%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-organized, actionable planning skill: concise catalog, concrete sequenced workflow with implicit safety gates, and clearly signaled references to leaf playbooks. The main gap is the absence of an explicit validation checkpoint and literal copy-paste seed JSON.

Suggestions

Add an explicit validation step to the workflow (e.g., 'Validate plan/threat-profile.json and conops.json against decepticon.core.schemas before handoff') so the sequence has a hard checkpoint.

Include a minimal copy-paste ThreatProfile seed snippet or a pointer to a template file so step 3 ('Copy the ThreatProfile seed') is fully actionable.

Confirm the referenced files exist at the cited paths (../references/apt-groups.md, ../references/adversary-archetypes.md, emulation/<actor>/SKILL.md) so the one-level-deep navigation resolves.

Dimension	Reasoning	Score
Conciseness	The body is lean — a compact actor table, a 6-step procedure, anatomy and discipline bullets — and assumes domain knowledge rather than explaining it; the only mild trim candidate is the blockquote clarifying Soundwave vs executing agents, which keeps it just shy of a 5.	4 / 5
Actionability	Concrete, executable guidance throughout — explicit `load_skill("/skills/standard/soundwave/threat-profile/emulation/<actor>/SKILL.md")` calls and named output files (`plan/threat-profile.json`, `conops.json`, `abort.json`, `deconfliction.json`) — with only minor gaps (no literal JSON snippets to copy) keeping it from a 5.	4 / 5
Workflow Clarity	The 'How to use a playbook' section is a clearly ordered 6-step sequence with implicit checkpoints (RoE-pruning drops empty phases in step 3, safety gates carried in step 5) and a defined handoff; it lacks an explicit 'validate the JSON' step, so it is not a 5.	4 / 5
Progressive Disclosure	The SKILL.md is an overview/catalog that signals one-level-deep references to leaf playbooks (`emulation/<actor>/SKILL.md`) and sibling references (`../references/apt-groups.md`, `../references/adversary-archetypes.md`) with clear navigation; no bundle directories are present to verify further, so structure is good but not the textbook 5.	4 / 5
	Total	16 / 20 Passed

Description

87%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that states concrete actions and an explicit trigger clause, giving it clear what+when coverage and a distinct niche. Slight headroom remains on specificity and trigger-term breadth (a few natural synonyms are missing).

Dimension	Reasoning	Score
Specificity	Names the domain and several concrete actions — 'turn an APT/eCrime threat profile into Decepticon CONOPS phases + OPPLAN objectives', 'pick the actor, seed plan/threat-profile.json, then map each kill-chain phase to the operational skill' — which is several specific actions with only minor coverage gaps, not the exhaustive list a 5 would require.	4 / 5
Completeness	Clearly and explicitly answers both 'what' (an adversary-emulation playbook catalog / routing skill producing CONOPS + OPPLAN objectives) and 'when' (an explicit 'Triggers on' clause with concrete trigger phrases).	5 / 5
Trigger Term Quality	An explicit 'Triggers on' clause lists natural phrases a user would say ('emulate', 'adversary emulation', 'APT playbook', 'threat actor playbook', 'emulation plan', 'attack flow'); good coverage with a few common synonyms (e.g. 'red team', 'emulate adversary') absent, so not a 5.	4 / 5
Distinctiveness Conflict Risk	It carves a clear niche — per-actor APT/eCrime kill-chain routing — with distinct triggers ('APT playbook', 'adversary emulation') that would not fire for unrelated skills, minimizing conflict risk.	5 / 5
	Total	18 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/soundwave/threat-profile/emulation/SKILL.md
Commit: 0cf691e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.