CtrlK
BlogDocsLog inGet started
Tessl Logo

ics-ot-overview

ICS / OT attack category — Modbus, BACnet, S7Comm, DNP3. Routing skill: fingerprint the industrial protocol by port + Wireshark dissector, then load the matching sub-skill. SAFETY-CRITICAL: always confirm written scope before any write/control class action.

62

Quality

74%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/exploit/ics-ot/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

78%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A compact, well-structured routing skill with concrete executable enumeration guidance and an explicit safety checkpoint for destructive ICS/OT operations. Its main limitation is that it routes to sub-skills by name without showing any protocol-interaction examples inline.

DimensionReasoningScore

Conciseness

The body is lean — protocol/port tables, a single nmap sweep command, and a compact tooling table with no over-explanation of concepts Claude already knows; the 'Defender baseline' section is slightly tangential for an attack-routing skill but brief.

4 / 5

Actionability

Provides a fully copy-paste-ready nmap fingerprint sweep and concrete port/tool tables, but stops at enumeration and naming sub-skills rather than showing protocol-interaction examples, leaving minor gaps.

4 / 5

Workflow Clarity

The sequence (fingerprint by port + wire format, then load the matching sub-skill) is clear and includes an explicit SAFETY FIRST validation gate for destructive write/control operations, satisfying the destructive-ops checkpoint requirement; lacks a feedback loop for unresolved fingerprints so it does not reach 5.

4 / 5

Progressive Disclosure

A simple, single-purpose routing skill under 50 lines with well-organized sections (SAFETY FIRST, Protocol routing, fingerprint sweep, tooling, defender baseline) and one-level references to named sub-skills, meeting the simple-skills exception for a top score.

5 / 5

Total

17

/

20

Passed

Description

70%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A specific, distinctive routing description with strong protocol-level trigger terms and an embedded safety directive, weakened only by the absence of an explicit 'Use when...' trigger clause. Third-person voice is maintained throughout.

Suggestions

Add an explicit 'Use when...' clause (e.g., 'Use when engaging ICS/OT or SCADA targets over Modbus, BACnet, S7Comm, or DNP3') to lift completeness above 3.

Surface common synonyms (SCADA, PLC, RTU, HMI) in the description itself rather than only in metadata to improve trigger-term coverage.

DimensionReasoningScore

Specificity

Names the domain and concrete protocols (Modbus, BACnet, S7Comm, DNP3) plus specific actions ('fingerprint the industrial protocol by port + Wireshark dissector, then load the matching sub-skill'), but the action set is essentially two steps (fingerprint, route) rather than a comprehensive list.

4 / 5

Completeness

The 'what' is clear (a routing skill that fingerprints protocols and loads sub-skills with a safety directive), but there is no explicit 'Use when...' clause, so per the rubric the missing explicit trigger guidance caps completeness at 3.

3 / 5

Trigger Term Quality

Includes the natural protocol keywords users would say ('ICS / OT', 'Modbus, BACnet, S7Comm, DNP3'), though common synonyms like SCADA, PLC, RTU, and HMI appear only in metadata rather than the description itself.

4 / 5

Distinctiveness Conflict Risk

The ICS/OT niche with named industrial protocols and ports is highly distinctive and unlikely to trigger for unrelated skills, giving minimal conflict risk.

5 / 5

Total

16

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

Total

15

/

16

Passed

Repository
PurpleAILAB/Decepticon
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.