Tessl • The management layer for AI agent skills

SkillPublic

exploit-reporting

Exploitation finding documentation — initial access reports, exploit chain documentation, CVSS v4.0 scoring, shell/credential inventory, detection gap analysis.

Quality

75%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/exploit/reporting/SKILL.md

Quality

Content

71%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable — complete templates, exact commands, JSON schemas, and quality checklists leave no ambiguity about what to produce. Its weaknesses are token efficiency (redundant CVSS/MITRE reference material Claude already knows) and a monolithic single-file layout that inlines content suited to reference files. An explicit ordered workflow and pruning or externalizing the reference tables would raise the score.

Suggestions

Move the CVSS reference-score table, severity bands, and MITRE ATT&CK technique tables into references/ files (e.g., references/cvss-scores.md, references/mitre-tags.md), keeping only a few common vectors and a pointer inline in SKILL.md.

Delete or compress the "Key CVSS 4.0 Metrics (vs 3.1)" and severity-band tables — this is standard CVSS knowledge Claude already has and adds tokens without new information.

Add an explicit ordered workflow section (e.g., 1. verify access, 2. write FIND-NNN.md, 3. record shell/cred entries, 4. create attack path if chained, 5. run the Section 9 checklist) so the sequence and validation loop are stated once rather than implied by section order.

Dimension	Reasoning	Score
Conciseness	The finding template, pre-calculated CVSS vectors, checklists, and file layout are engagement-specific and earn their tokens, but the "CVSS 4.0 Severity Bands" table, "Key CVSS 4.0 Metrics (vs 3.1)" table, and MITRE technique-name columns restate knowledge Claude already has. This is mostly efficient with some unnecessary reference material that could be trimmed, matching anchor 3 rather than 4.	3 / 5
Actionability	The skill provides a complete copy-paste-ready finding template with exact frontmatter fields, verbatim curl commands, JSON entry schemas for shells and credentials, an evidence naming convention with concrete examples, and a file layout tree. This fully matches the anchor for executable, specific guidance covering common cases.	5 / 5
Workflow Clarity	Sequencing is supported by the ID assignment rule, the shell/cred linking rules ("Every `SHELL-NNN` entry MUST have a `finding_id`"), and the Section 9 quality checklist as a validation checkpoint. It is not a 5 because the artifact-creation order (finding file → shells/creds entries → attack path) is implied by section order rather than stated as one explicit ordered procedure with feedback loops.	4 / 5
Progressive Disclosure	The body is well-organized into nine numbered sections, but at ~420 lines it inlines substantial lookup-table content (CVSS reference scores, severity bands, MITRE technique tables) that belongs in references/ files, and no bundle files exist. This matches anchor 3: some structure, but content that should be separate is inline.	3 / 5
	Total	15 / 20 Passed

Description

71%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and capability-rich, clearly delineating a post-exploitation documentation niche. Its main weakness is the absence of a "Use when..." trigger clause, which caps completeness, and some missing natural trigger phrasing. Adding an explicit trigger sentence would lift the two weakest dimensions.

Suggestions

Append an explicit trigger clause to the description, e.g., "Use when writing up a verified exploit, documenting a shell or captured credentials, scoring a finding with CVSS, or reporting detection gaps."

Include natural user phrasings and synonyms in the description (e.g., "pentest writeup", "proof of exploitation", "finding report") to broaden trigger coverage beyond jargon-adjacent nouns.

State the output artifacts in the description (FIND-NNN.md finding files, shells.json/creds.json entries, attack-path documents) to sharpen distinctiveness from generic reporting skills.

Dimension	Reasoning	Score
Specificity	The description lists five concrete capabilities — "initial access reports, exploit chain documentation, CVSS v4.0 scoring, shell/credential inventory, detection gap analysis" — under a clearly named domain, matching the comprehensive-coverage anchor. It is not a 4 because the capability list has no material gaps in coverage.	5 / 5
Completeness	The "what" is clear and concrete, but the description contains no "Use when..." clause or equivalent explicit trigger guidance, which caps completeness at 3 per the judging guidelines. It is not a 2 because the "what" is detailed rather than vague.	3 / 5
Trigger Term Quality	Good keyword coverage including "exploit", "report", "CVSS", "shell", "credential", and "detection gap", but natural variations a user would say (e.g., "pentest writeup", "document a shell", "proof of exploitation") are missing. This sits between anchor 3 and 5, noticeably above the midpoint.	4 / 5
Distinctiveness Conflict Risk	Phrases like "CVSS v4.0 scoring, shell/credential inventory, detection gap analysis" carve a distinct post-exploitation documentation niche with minor overlap risk against sibling pentest reporting skills. It is not a 5 because "reports" and "findings" remain broad terms that could collide with general reporting skills in the same suite.	4 / 5
	Total	16 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
metadata_field	'metadata' should map string keys to string values	Warning

	Total	14 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/exploit/reporting/SKILL.md
Revision: 49888ee

Reviewed: 13 days ago

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.

exploit-reporting

Table of Contents

Is this your skill?