CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

emulation-scattered-spider

Scattered Spider (UNC3944 / Octo Tempest) adversary-emulation playbook — help-desk vishing → MFA takeover → cloud/SaaS/identity privilege expansion → RMM persistence → data-theft extortion. Use when emulating identity-first social-engineering eCrime against a help-desk/IdP estate. Triggers on: 'emulate Scattered Spider', 'UNC3944', 'Octo Tempest', '0ktapus', 'help desk social engineering', 'MFA fatigue', 'SIM swap', 'identity attack'.

Quality

96%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

93%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A tight, high-fidelity emulation playbook: everything is concrete and copyable, the kill chain is explicitly sequenced with safety gates and an abort trigger, and structure is clean with clearly signaled one-level external references. The only minor gap is the absence of per-phase validation/feedback loops, which keeps workflow clarity at 4 rather than 5.

DimensionReasoningScore

Conciseness

The body is dense and lean — a blockquote profile, a JSON seed, a table, and short sectioned checklists — with no explanation of concepts Claude already knows and every token earning its place; nothing to trim without losing fidelity-relevant detail.

5 / 5

Actionability

Copy-paste-ready artifacts: a fill-in ThreatProfile JSON seed, a 10-row kill-chain table mapping each phase to MITRE technique + executing agent + concrete skill path, a numbered CONOPS to copy into conops.json, and an exact EMERGENCY abort-trigger string — fully actionable instruction guidance per the code-vs-instruction scoring note.

5 / 5

Workflow Clarity

The 10-phase sequence is explicit, cross-referenced by a CONOPS numbering map, and includes real checkpoints (written-authorization gate, canary-only impact, EMERGENCY abort trigger, deconfliction/cleanup recording). It falls short of anchor 5 only in lacking per-phase validate-then-proceed feedback loops; the destructive-operation cap to 3 does not apply since safety gates and abort conditions are explicitly stated.

4 / 5

Progressive Disclosure

No bundle files exist (references/, scripts/, assets/ all absent), so the skill is self-contained at ~93 well-sectioned lines with nothing that should be split out; external skill references (one level deep) are clearly signaled with explicit paths in the kill-chain table, and the references named in the body all point to that external ecosystem rather than nonexistent bundle files.

5 / 5

Total

19

/

20

Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

Excellent description: concise third-person statement of the multi-phase capability, an explicit 'Use when' clause, and a rich trigger list including the actor's aliases. Fully matches the rubric's good-example pattern with no padding or over-claims.

DimensionReasoningScore

Specificity

The description lists multiple concrete, chained actions — 'help-desk vishing → MFA takeover → cloud/SaaS/identity privilege expansion → RMM persistence → data-theft extortion' — comprehensively covering the actor's kill chain, matching the top anchor rather than the 'several specific actions; minor gaps' anchor.

5 / 5

Completeness

It explicitly answers both 'what' (the full phase chain) and 'when' ('Use when emulating identity-first social-engineering eCrime against a help-desk/IdP estate' plus concrete trigger phrases), exactly matching the anchor-5 example pattern.

5 / 5

Trigger Term Quality

An explicit 'Triggers on:' clause covers natural terms and synonyms users would say: 'emulate Scattered Spider', 'UNC3944', 'Octo Tempest', '0ktapus', 'help desk social engineering', 'MFA fatigue', 'SIM swap', 'identity attack' — comprehensive alias coverage befitting the top anchor.

5 / 5

Distinctiveness Conflict Risk

It names a specific threat actor (Scattered Spider/UNC3944/Octo Tempest) with distinct, niche-specific triggers, so overlap with any other skill's trigger surface is minimal.

5 / 5

Total

20

/

20

Passed

Validation

87%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

metadata_field

'metadata' should map string keys to string values

Warning

Total

14

/

16

Passed

Repository

PurpleAILAB/Decepticon

Path

packages/decepticon/decepticon/skills/standard/soundwave/threat-profile/emulation/scattered-spider/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.