CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

ics-bacnet

BACnet/IP attack — UDP/47808 discovery via Who-Is broadcast, ReadProperty / WriteProperty without auth, BBMD abuse for remote reach, vendor-specific I-Am responses, COV (Change Of Value) subscription flood, Building Automation HMI pivot.

Quality

79%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/exploit/ics-ot/bacnet/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

76%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A dense, expert-level reference with genuinely executable commands for most operations, undermined by a command-less BBMD section and no validation loop around its destructive write operations. The single-file organization is solid but vendor and pivot details are natural candidates for reference files.

Suggestions

Add a read-back validation step after each WriteProperty (e.g. 'bacrp 1234 4 5 85' to confirm the value and priority took effect, plus how to relinquish with WritePriority 16/RelinquishDefault) — required to lift the workflow-clarity cap on this destructive skill.

Make the BBMD section executable: give a concrete command for registering as a foreign device or targeting a BBMD's broadcast distribution table (e.g. via bvcli or a bacpypes example), and add example commands for the vendor-specific overrides.

Fix the bacpypes snippet so it actually runs (start the event loop and print I-Am responses), and consider moving vendor-specific and sub-protocol pivot details into reference files to slim the main body.

DimensionReasoningScore

Conciseness

The body is lean and assumes competence throughout, delivering only non-obvious domain knowledge (property 76 = object-list, property 85 = present-value, priority 8 = manual operator, vendor ID mappings) via terse commands and one-liners with no padding or basic-concept explanation.

5 / 5

Actionability

Most commands are copy-paste ready with full arguments ('bacrp 1234 8 1 85', 'bacwp 1234 4 5 85 8 -1 0', 'bacscov 1234 0 1 60'), but the BBMD abuse section provides only descriptive comments with no command, vendor-specific overrides list writable properties without any example command, and the bacpypes snippet imports run/stop without ever starting the event loop so it would not actually emit Who-Is.

4 / 5

Workflow Clarity

A coherent sequence is present (Discover → Read → Write → COV → Pivot) with a safety warning on setpoint changes, but the core workflow is destructive (writes to physical outputs, device restarts) and lacks any validation — no read-back of present-value after WriteProperty and no confirmation of priority-array effect — so workflow clarity is capped at 3.

3 / 5

Progressive Disclosure

No bundle files exist, and the single-file body is well-sectioned with a clear references section at the end. Minor gaps remain: vendor-specific overrides and the sub-protocol pivot details (MS/TP, Modbus, LonWorks, KNX) are separable content that could live in reference files.

4 / 5

Total

16

/

20

Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A highly specific, distinctive description with comprehensive concrete actions, undermined by the complete absence of a 'when to use' clause. Natural trigger terms beyond the technical vocabulary (HVAC, BAS) would also strengthen discovery.

Suggestions

Append a 'Use when...' clause naming natural triggers, e.g. 'Use when targeting BACnet, BACnet/IP, building automation systems, HVAC controls, or UDP/47808.'

Add natural synonyms users would say — 'HVAC', 'BAS', 'building automation system' — alongside the protocol jargon.

Clarify that the trigger keywords currently live only in metadata.when_to_use; surface the key ones in the description itself so discovery works from the description alone.

DimensionReasoningScore

Specificity

The description lists multiple concrete protocol-specific actions — 'UDP/47808 discovery via Who-Is broadcast', 'ReadProperty / WriteProperty without auth', 'BBMD abuse for remote reach', 'COV (Change Of Value) subscription flood', 'Building Automation HMI pivot' — comprehensively covering the skill's attack surface with no coverage gaps.

5 / 5

Completeness

The 'what' is clearly stated via multiple concrete actions, but the description contains no 'Use when...' clause or equivalent explicit trigger guidance, which caps completeness at 3 per the rubric guideline.

3 / 5

Trigger Term Quality

Strong technical keywords are present (BACnet/IP, Who-Is, BBMD, COV, UDP/47808, Building Automation), but natural user phrases like 'HVAC', 'BAS', or 'building automation system' are missing from the description, so a few natural trigger terms a user would say are absent.

4 / 5

Distinctiveness Conflict Risk

BACnet/IP is a clear niche with protocol-distinct triggers (Who-Is, BBMD, COV, port 47808) that no other plausible skill would match, giving minimal conflict risk.

5 / 5

Total

17

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

Total

15

/

16

Passed

Repository

PurpleAILAB/Decepticon

Path

packages/decepticon/decepticon/skills/standard/exploit/ics-ot/bacnet/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.