emulation-scattered-spider

Scattered Spider (UNC3944 / Octo Tempest) adversary-emulation playbook — help-desk vishing → MFA takeover → cloud/SaaS/identity privilege expansion → RMM persistence → data-theft extortion. Use when emulating identity-first social-engineering eCrime against a help-desk/IdP estate. Triggers on: 'emulate Scattered Spider', 'UNC3944', 'Octo Tempest', '0ktapus', 'help desk social engineering', 'MFA fatigue', 'SIM swap', 'identity attack'.

Quality

89%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

78%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A dense, well-structured adversary-emulation playbook with concrete kill-chain mapping, explicit safety gates, and clear cross-skill orchestration. It is token-efficient and actionable, with only minor redundancy and the inherent limitation of delegating execution to other skills.

Suggestions

Trim the opening blockquote — it restates the kill chain already captured in the table and the description frontmatter, saving tokens without losing information.

Add a short inline validation checkpoint inside the CONOPS kill_chain (e.g., 'after initial-access, confirm reset + MFA control before expanding scope') to strengthen the feedback loop.

Optionally surface the threat-profile.json field requirements inline (e.g., which fields are mandatory vs optional) so Claude can fill them without guessing.

Dimension	Reasoning	Score
Conciseness	Lean and dense with no over-explanation of concepts Claude already knows; the opening blockquote slightly restates the kill chain already laid out in the table, a minor instance of redundancy that keeps it below 5.	4 / 5
Actionability	Provides concrete, actionable artifacts (threat-profile JSON, MITRE-mapped kill-chain table, CONOPS kill_chain list, named abort trigger and deconfliction POC) with minor gaps — it orchestrates other skills rather than giving copy-paste commands itself.	4 / 5
Workflow Clarity	A clearly sequenced 10-phase kill chain collapsed into a 5-stage CONOPS, with explicit RoE/safety gates, an EMERGENCY abort trigger, and a deconfliction checklist; minor validation gaps keep it just below 5.	4 / 5
Progressive Disclosure	Well-organized single-file SKILL.md with clearly signaled one-level-deep external references (/skills/standard/.../SKILL.md) and no nested references; no bundle files exist, so structure is good but not a multi-file overview deserving 5.	4 / 5
	Total	16 / 20 Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A high-quality description that is specific, comprehensive, and well-triggered with both actor synonyms and technique keywords. It cleanly answers what the skill does and when to use it with minimal conflict risk.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete kill-chain actions ('help-desk vishing', 'MFA takeover', 'cloud/SaaS/identity privilege expansion', 'RMM persistence', 'data-theft extortion') forming comprehensive coverage of the adversary's behavior.	5 / 5
Completeness	Explicitly answers both 'what' (adversary-emulation playbook with full kill chain) and 'when' ('Use when emulating identity-first social-engineering eCrime against a help-desk/IdP estate' plus an explicit 'Triggers on:' clause).	5 / 5
Trigger Term Quality	Provides comprehensive natural trigger terms including actor synonyms ('Scattered Spider', 'UNC3944', 'Octo Tempest', '0ktapus') and technique phrases ('MFA fatigue', 'SIM swap', 'identity attack') users would naturally say.	5 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (Scattered Spider identity-first eCrime emulation) with distinct actor-alias triggers, making overlap with unrelated skills minimal.	5 / 5
	Total	20 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/soundwave/threat-profile/emulation/scattered-spider/SKILL.md
Commit: 0cf691e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.