exploit-reporting

Exploitation finding documentation — initial access reports, exploit chain documentation, CVSS v4.0 scoring, shell/credential inventory, detection gap analysis.

Quality

65%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/exploit/reporting/SKILL.md

Quality

Content

71%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with concrete templates, schemas, and checklists, and the workflow is reasonably clear with a validation checklist. Its main weaknesses are length/conciseness (a very large inlined example) and the absence of any progressive file-splitting for a 464-line skill.

Suggestions

Move the CVSS v4.0 reference scores, severity bands, and metric comparison tables (Section 2) and the MITRE ATT&CK technique reference (Section 6) into separate reference files linked from the body to improve progressive disclosure.

Trim the single full finding example to a compact skeleton with one short populated section, or split the worked example into a references/ file, to reduce the ~127-line inline block.

Add an explicit numbered workflow summary near the top (find file -> document -> record shell/cred -> attack path -> update opplan -> run pre-submission checklist) with an explicit validate-and-fix loop to push workflow clarity toward 5.

Dimension	Reasoning	Score
Conciseness	Mostly efficient reference material (CVSS vectors, MITRE tables, JSON schemas earn their place), but the single full finding example (~127 lines) and some explanatory prose could be tightened; it is not under 50 lines so the simple-skill exception does not apply.	3 / 5
Actionability	Provides copy-paste-ready finding templates, shell/credential JSON schemas, exact file paths, naming conventions, CVSS vector strings, and checklists that cover the common reporting cases concretely.	5 / 5
Workflow Clarity	A clear sequence exists (produce finding file, record shell/cred, build attack path, update opplan, append findings.txt) with a pre-submission checklist acting as a validation checkpoint; minor gaps in explicit feedback-loop framing keep it just below 5.	4 / 5
Progressive Disclosure	Well structured into 9 numbered sections, but at 464 lines everything is inlined with no bundle files; large reference tables (CVSS vectors, MITRE techniques) that belong in separate files are kept inline, so it is not a simple-skill 5.	3 / 5
	Total	15 / 20 Passed

Description

58%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description clearly conveys what the skill produces via a concrete list of reporting artifacts, but lacks an explicit 'when to use' trigger clause and buries its best trigger terms in metadata rather than the description. Specificity and distinctiveness are solid; completeness and trigger-term quality are the weak spots.

Suggestions

Add an explicit 'Use when...' clause to the description (e.g., 'Use when documenting an exploitation finding, scoring a vuln with CVSS v4.0, or inventorying shells/creds after access') to satisfy the 'when' half of completeness.

Surface natural trigger phrases ("write finding", "document exploit", "shell obtained", "credential found") directly in the description instead of only in metadata.when_to_use.

Convert noun-phrase artifacts into concrete verb actions (e.g., 'Document initial access, score findings with CVSS v4.0, inventory shells and credentials') to lift specificity from 4 toward 5.

Dimension	Reasoning	Score
Specificity	Lists several concrete capabilities ("initial access reports, exploit chain documentation, CVSS v4.0 scoring, shell/credential inventory, detection gap analysis"), though they are noun-phrase artifacts rather than verb actions, leaving minor coverage gaps.	4 / 5
Completeness	The 'what' is clear (exploitation finding documentation with enumerated artifacts) but there is no 'Use when...' clause or equivalent trigger guidance, which caps completeness at 3 per the rubric.	3 / 5
Trigger Term Quality	Contains relevant keywords ("exploit chain", "CVSS", "shell", "credential", "detection gap") but misses common natural variations a user would actually say; the richer trigger phrases live in metadata.when_to_use rather than the description itself.	3 / 5
Distinctiveness Conflict Risk	The exploitation-reporting niche with CVSS/shell/cred/detection-gap specifics is mostly distinct, with only minor overlap risk against a general reporting skill.	4 / 5
	Total	14 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
metadata_field	'metadata' should map string keys to string values	Warning

	Total	14 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/exploit/reporting/SKILL.md
Commit: 0cf691e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.