CtrlK
BlogDocsLog inGet started
Tessl Logo

ics-dnp3

DNP3 attack — TCP/20000 (or 19999 serial-over-TCP) outstation enumeration, binary input / analog input poll, control relay output block (CROB) actuation, unsolicited reporting abuse, DNP3 Secure Authentication (DNP3-SA) downgrade, vendor-specific objects.

52

Quality

58%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/exploit/ics-ot/dnp3/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

50%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body delivers concrete, domain-rich DNP3 attack guidance with clear safety emphasis, but suffers from incomplete code placeholders, missing validation checkpoints for destructive ops, and a monolithic structure with no progressive disclosure.

Suggestions

Replace placeholder/pseudocode blocks ('# ... master init + asyncrun ...', DNP3-SA 'Check via examples') with complete, runnable snippets or explicitly justify the abbreviation.

Add an explicit validation checkpoint before any control-class write (e.g., confirm point map, then Select-only dry run, then Operate) so destructive operations have a feedback loop.

Split the vendor index table and detailed reference list into a separate references file linked from SKILL.md to enable one-level-deep progressive disclosure.

DimensionReasoningScore

Conciseness

Mostly efficient with concrete code blocks, but includes explanatory prose Claude already knows ('This is the single most dangerous DNP3 primitive...', 'Class 0 = static (current value of every point)') that could be tightened; not a 1 because the body is not padded with generic background.

2 / 3

Actionability

Provides concrete commands and code, but several examples are incomplete — '# ... master init + asyncrun ...' placeholders, '# Check via opendnp3.SecureAuthentication examples' with no runnable code — so guidance is partially pseudocode rather than copy-paste ready.

2 / 3

Workflow Clarity

Sequenced sections (Discover → Read → Control) are present and safety is stressed, but the HIGH-IMPACT destructive control operations lack an explicit validate/confirm checkpoint or fix-and-retry feedback loop, capping workflow clarity at 2 per the rubric.

2 / 3

Progressive Disclosure

Single ~119-line monolithic SKILL.md with inline vendor tables and reference lists; no bundle files exist and nothing is split into separate reference files, so it is organized but not progressively disclosed one level deep.

2 / 3

Total

8

/

12

Passed

Description

67%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and distinctive, clearly carving out a DNP3/SCADA niche with concrete attack primitives. Its main weakness is the missing explicit 'Use when...' trigger clause in the description itself and reliance on jargon-heavy trigger terms.

Suggestions

Add an explicit 'Use when ...' clause to the description field (e.g., 'Use when attacking DNP3 outstations or when the user mentions DNP3, RTUs, or port 20000') so completeness can score 3.

Soften trigger terms toward natural user phrasing — include 'SCADA', 'substation', 'RTU' alongside the protocol jargon so a user's casual request still matches.

DimensionReasoningScore

Specificity

Lists multiple concrete actions — 'outstation enumeration, binary input / analog input poll, control relay output block (CROB) actuation, unsolicited reporting abuse, DNP3 Secure Authentication (DNP3-SA) downgrade' — matching the multiple-specific-actions anchor.

3 / 3

Completeness

Strongly answers 'what' with enumerated capabilities, but there is no explicit 'Use when...' clause in the description field — the when guidance lives only in metadata, so per the guidelines completeness is capped at 2.

2 / 3

Trigger Term Quality

Includes relevant terms like 'dnp3', '20000', 'outstation' in when_to_use, but leans on technical jargon ('crob', 'unsolicited', 'dnp3-sa') a user would not naturally say, missing common variations; not a 1 because 'dnp3' and 'rtu' are genuinely natural.

2 / 3

Distinctiveness Conflict Risk

A clear, narrow niche (DNP3 utility SCADA over TCP/20000) with protocol-specific triggers that are unlikely to conflict with other skills, matching the clear-niche anchor.

3 / 3

Total

10

/

12

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

Total

15

/

16

Passed

Repository
PurpleAILAB/Decepticon
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.