exploit-deserialization

Insecure deserialization — RCE via malicious serialized objects in Java (ysoserial), PHP (PHPGGC), .NET (ysoserial.net), and Python (pickle). Covers gadget chain selection, payload generation, and injection into cookies, POST bodies, ViewState, and API endpoints.

Quality

76%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/exploit/web/deserialization/SKILL.md

Quality

Content

63%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

Highly actionable and well-sequenced with strong validation checkpoints, but the skill is a verbose monolith: it explains concepts at length and inlines multiple advanced chains that belong in separate reference files, hurting both conciseness and progressive disclosure.

Suggestions

Move the advanced PHAR/SSRF and custom-PHAR chains into separate reference files (e.g. references/phar-chains.md, references/custom-gadget.md) and keep SKILL.md as a concise overview with one-level-deep links.

Trim conceptual explanation (e.g. PHAR wrapper mechanics, namespace serialization encoding details) that Claude already knows or that can live in references.

Extract the endpoint-permutation wordlist script into scripts/ to reduce inline bulk.

Dimension	Reasoning	Score
Conciseness	The body is ~295 lines of densely written prose including substantial explanation of concepts (PHAR wrapper mechanics, SSRF body-control gotchas, namespace serialization encoding) that is highly detailed and padded well beyond what a lean skill reference requires.	2 / 5
Actionability	Provides fully executable, copy-paste-ready commands and scripts for every language (ysoserial, phpggc, ysoserial.net, pickle, custom PHAR builder), with specific flags, endpoints, and verification steps covering common cases.	5 / 5
Workflow Clarity	Multi-step chains are explicitly sequenced with numbered steps, pre-conditions, validation/verification (side-effect checks, signature verification), and feedback loops (workaround ladder 1->5, re-validate loops); the auth-cookie checkpoint is a clear validation gate.	5 / 5
Progressive Disclosure	No bundle files exist (references/, scripts/, assets/ absent) and the SKILL.md is a monolithic ~295-line wall covering multiple language sections and several long advanced sub-chains that would clearly benefit from being split into separate reference files.	2 / 5
	Total	14 / 20 Passed

Description

90%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description with concrete capabilities, rich trigger terms, and clear distinctiveness. The main weakness is the absence of an explicit 'Use when...' trigger clause, which caps completeness at 4.

Suggestions

Add an explicit 'Use when...' clause naming the trigger scenarios (e.g. 'Use when the user mentions insecure deserialization, unserialize/pickle sinks, or RCE via serialized objects').

Consider noting the offensive/exploitation context explicitly so the skill is distinguishable from defensive deserialization-analysis skills.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions across four languages/frameworks — 'gadget chain selection, payload generation, and injection into cookies, POST bodies, ViewState, and API endpoints' — covering comprehensive RCE capability.	5 / 5
Completeness	The 'what' is explicit and concrete; the 'when' is only weakly implied (no 'Use when...' clause), so per the rubric a missing explicit trigger guidance caps completeness at 4 rather than 5.	4 / 5
Trigger Term Quality	Includes natural user-facing terms (deserialization, pickle, ysoserial, phpggc, gadget chain, viewstate) plus format signatures (rO0AB, aced0005) and synonyms, giving comprehensive coverage.	5 / 5
Distinctiveness Conflict Risk	The niche is narrow and clearly bounded to insecure-deserialization RCE with language-specific signatures; trigger terms (ysoserial, phpggc, rO0AB) are distinctive and unlikely to fire for unrelated skills.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/exploit/web/deserialization/SKILL.md
Commit: 0cf691e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.