Tessl • The management layer for AI agent skills

SkillPublic

fin7

FIN7 (Carbon Spider / Sangria Tempest) adversary-emulation playbook — revenue-targeted spearphishing with phone follow-up, EDR-evasion tradecraft, AD compromise, and big-game-hunting ransomware. Use when emulating a high-end financially-motivated crew that graduated from POS theft to ransomware. Triggers on: 'emulate FIN7', 'Carbanak', 'Carbon Spider', 'Sangria Tempest', 'big game hunting', 'EDR evasion', 'AvNeutralizer'.

Quality

97%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

96%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a tightly written emulation playbook: dense actor-specific intelligence, a fully sequenced kill chain with concrete skill dispatch and safety gates, and copy-paste artifacts. Its only weakness is a cross-bundle reference ('../../references/apt-groups.md') that is not present in the skill's bundle, slightly marring an otherwise clean structure.

Suggestions

Verify or inline the industry → actor mapping referenced via '../../references/apt-groups.md' — the file is absent from this bundle, so either ship it in references/ or drop the pointer.

Add an explicit re-check step after the EDR-tamper phase (e.g., 'confirm EDR telemetry restored before proceeding') to close the workflow's only validation gap.

Consider moving the full ThreatProfile seed and kill-chain table into a references/ file if the skill grows, keeping SKILL.md as a shorter overview.

Dimension	Reasoning	Score
Conciseness	Lean and dense throughout — every section carries FIN7-specific intelligence Claude does not already have (aliases, MITRE mappings, AvNeutralizer/AuKill tradecraft, revenue-based targeting via Crunchbase/D&B/ZoomInfo) with zero explanation of known concepts. Matches the 5 anchor; the 4 anchor would require trimmable over-explanation, which is absent.	5 / 5
Actionability	Fully actionable for an instruction-only skill: a copy-paste ThreatProfile JSON seed, a kill-chain table giving exact executing-agent skill paths per phase, a CONOPS list to copy into conops.json, verbatim EMERGENCY abort wording, and named record files (deconfliction.json, cleanup.json). Guidance is specific down to exact commands-to-run-next.	5 / 5
Workflow Clarity	Clear 11-phase numbered sequence plus a 5-step CONOPS with explicit validation/safety checkpoints for the destructive operations: 'run on a lab/canary host first, and confirm rollback', canary-only impact, authorization gates, and a defined EMERGENCY abort condition. The destructive-operation cap does not apply because validation steps are present; the only gap (no re-validate retry loop) is minor for a planning playbook.	5 / 5
Progressive Disclosure	Well-organized single-file overview with clearly signaled one-level-deep references to executing skills in the kill-chain table, but the body points to '../../references/apt-groups.md' which does not exist in this bundle (no references/ directory present). That unverifiable reference is a minor organization gap, fitting the 4 anchor ('references mostly clear; minor organization gaps') rather than the 5 anchor.	4 / 5
	Total	19 / 20 Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is exemplary: third-person voice, concrete capability list, an explicit 'Use when' clause, and a rich set of natural trigger terms including group aliases and signature tool names. It comprehensively answers both what the skill does and when to use it with minimal conflict risk.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete capabilities — 'revenue-targeted spearphishing with phone follow-up, EDR-evasion tradecraft, AD compromise, and big-game-hunting ransomware' — giving comprehensive coverage of the playbook's actions, matching the top anchor rather than the 4 anchor since no capability area is missing.	5 / 5
Completeness	Explicitly answers both what (adversary-emulation playbook with named TTP areas) and when ('Use when emulating a high-end financially-motivated crew that graduated from POS theft to ransomware' plus concrete trigger phrases), matching the 5 anchor; the 4 anchor requires the 'when' to be less explicit, which it is not.	5 / 5
Trigger Term Quality	Explicit trigger list covers natural phrasings and synonyms users would say: 'emulate FIN7', 'Carbanak', 'Carbon Spider', 'Sangria Tempest', 'big game hunting', 'EDR evasion', 'AvNeutralizer' — comprehensive alias and synonym coverage.	5 / 5
Distinctiveness Conflict Risk	A clearly actor-specific niche (FIN7 emulation) with distinct alias-based triggers; virtually no overlap risk with generic skills since the triggers name the group and its unique tradecraft terms.	5 / 5
	Total	20 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
metadata_field	'metadata' should map string keys to string values	Warning

	Total	14 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/soundwave/threat-profile/emulation/fin7/SKILL.md
Revision: 49888ee

Reviewed: 13 days ago

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.

fin7

Table of Contents

Is this your skill?