CtrlK
BlogDocsLog inGet started
Tessl Logo

hardcoded-creds

Systematic hunt for hardcoded credentials, API keys, certificates, and default passwords in extracted IoT firmware. Covers /etc/shadow and passwd parsing, busybox httpd configs, telnet/dropbear stanzas, MQTT/cloud API key extraction, and cross-referencing against known default-credential databases.

63

Quality

75%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/iot/hardcoded-creds/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

76%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable and efficiently structured as a phase-by-phase playbook, but it lacks explicit validation/feedback checkpoints for its destructive batch operations, which limits workflow clarity.

Suggestions

Add explicit validation checkpoints after risky batch steps (e.g., confirm a cracked hash actually authenticates before recording it, or verify a private key matches its certificate before escalating severity).

Introduce a brief validate->fix->retry loop for the hash-cracking and key-matching phases to satisfy the destructive/batch workflow requirement.

Consider moving the vendor default-credential matrix and the strings-sweep patterns into reference files to improve progressive disclosure.

DimensionReasoningScore

Conciseness

The body is mostly lean bash with terse inline comments and minimal generic concept explanation, though a few comment lines (e.g., hash-type mnemonics and tool rationale) could be trimmed, fitting the 'efficient with minor over-explanation' anchor.

4 / 5

Actionability

Provides fully executable, copy-paste-ready bash with concrete flags, file paths, hashcat modes, an openssl modulus-matching sequence, and a vendor default-credential matrix — covering the common cases concretely.

5 / 5

Workflow Clarity

Seven phases are clearly sequenced with prerequisites and an Evidence section, but destructive/batch operations (fleet-wide cracking, key extraction) lack explicit validate->fix->retry feedback loops, which caps workflow clarity at 3 per the rubric.

3 / 5

Progressive Disclosure

Well-organized with clear phase section headers, a vendor matrix, OPSEC notes, and an external References list, though several multi-phase blocks could plausibly live in separate reference files; no bundle files are present to offload detail.

4 / 5

Total

16

/

20

Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is highly specific and clearly distinct within the IoT-firmware credential-hunting niche, but it omits an explicit 'Use when...' trigger clause, which limits completeness and natural trigger phrasing.

Suggestions

Add an explicit 'Use when...' clause (e.g., 'Use when analyzing extracted IoT firmware for hardcoded or default credentials') to fully answer the 'when' trigger.

Broaden trigger-term coverage in the description with synonyms and file/extension hints (e.g., 'firmware credentials', 'embedded secrets', '.conf files').

Consider including common user phrases such as 'default login' or 'firmware password' directly in the description rather than only in metadata.

DimensionReasoningScore

Specificity

Lists multiple concrete actions — '/etc/shadow and passwd parsing', 'busybox httpd configs', 'telnet/dropbear stanzas', 'MQTT/cloud API key extraction', 'cross-referencing against known default-credential databases' — giving comprehensive coverage of the skill's scope.

5 / 5

Completeness

The 'what' is clearly and concretely stated, but there is no explicit 'when'/'Use when...' trigger clause — the trigger context is only weakly implied, which caps completeness at 3 per the rubric guideline.

3 / 5

Trigger Term Quality

Contains natural keywords like 'hardcoded credentials', 'API keys', 'default passwords', and 'IoT firmware', but lacks the explicit 'Use when...' phrasing and synonyms/file extensions in the description itself, so a few natural terms are missing.

4 / 5

Distinctiveness Conflict Risk

The IoT-firmware credential-hunting niche with concrete artifact types (shadow, busybox httpd, dropbear, MQTT) is clearly distinct with minimal conflict risk against other skills.

5 / 5

Total

17

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

Total

15

/

16

Passed

Repository
PurpleAILAB/Decepticon
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.