ics-overview

Use when the target is an industrial control system or operational technology network running Modbus, BACnet, S7Comm/S7Comm Plus, DNP3, OPC-UA, or any PLC/HMI/SCADA stack. Engagements MUST set RoE flag industrial_safety_critical=true; this catalog gates every write-scope operation behind explicit operator confirmation regardless of HITL middleware.

Quality

81%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

72%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, actionable ICS/OT skill body that respects the read-mostly safety model. The main gap is the absence of explicit validation/feedback-loop checkpoints around write-scope and extraction steps, which the rubric caps at workflow_clarity 3.

Suggestions

Add an explicit validate-then-proceed checkpoint for write-scope steps (e.g., 'After modbus-write: re-read the coil to confirm the intended value; abort and log if it diverges').

Expand the modbus-write / engineering-software rows with one copy-paste command or code snippet each so the gated write path is fully executable, not just described.

Make the SIL-based gating a numbered workflow checkpoint (e.g., step 2.5) rather than only prose, so the safety barrier is unambiguous in sequence.

Dimension	Reasoning	Score
Conciseness	The body is largely lean and assumes Claude's competence (named NSE scripts, tshark filters, SIL gating), with only minor padding such as 'Industrial engagements are not application security with longer rules of engagement' which is editorial rather than instructional.	4 / 5
Actionability	It gives concrete, runnable commands (tshark -Y modbus, nmap -sV --script modbus-discover, -T2) and named tools (Snap7, python-snap7), but the playbook table entries are short summaries without copy-paste code for each technique, leaving minor gaps for the write/discovery actions.	4 / 5
Workflow Clarity	The 5-step Workflow is sequenced, but destructive/write operations ('modbus-write') and project extraction lack explicit validate-then-proceed checkpoints; per the rubric cap, batch/destructive operations without validation feedback loops cap workflow_clarity at 3 even though the safety gate is mentioned.	3 / 5
Progressive Disclosure	For a self-contained skill with no bundle files, the body is well-organized into clear sections (Hard rules, Playbooks table, Workflow, Detection gap, Out of scope) and explicitly signals that the playbook entries are inline references rather than separate loadable skills, keeping navigation simple and one-level.	5 / 5
	Total	16 / 20 Passed

Description

91%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description with natural trigger terms and a clear niche. It would benefit from a more explicit one-clause summary of the skill's actual catalog content rather than leading so heavily with the engagement gating rule.

Suggestions

Open with a concise 'what this does' clause (e.g., 'Catalog of read-mostly discovery and gated write techniques for ICS/OT networks') before the gating rule, so 'what' is as clear as 'when'.

Consider adding the common file/asset shorthand (e.g., '.s7p', '.acd', 'project archive') as trigger terms since engineering-software extraction is a key capability.

Dimension	Reasoning	Score
Specificity	The description enumerates multiple concrete capabilities and targets (Modbus, BACnet, S7Comm/S7Comm Plus, DNP3, OPC-UA, PLC/HMI/SCADA) plus a concrete gating behavior ('gates every write-scope operation behind explicit operator confirmation'), giving comprehensive coverage.	5 / 5
Completeness	Both 'what' (gates write-scope operations behind operator confirmation) and 'when' (industrial control system / OT network running named protocols) are present and concrete, but the 'what' is skewed toward an engagement gating rule rather than a fuller statement of what the skill does (catalog of read-mostly discovery/write techniques).	4 / 5
Trigger Term Quality	It leads with 'Use when the target is an industrial control system or operational technology network running Modbus, BACnet...PLC/HMI/SCADA stack' — exactly the natural terms and protocol names a user would say, with strong synonym coverage (ICS, OT, PLC, HMI, SCADA, all major protocols).	5 / 5
Distinctiveness Conflict Risk	The ICS/OT safety-critical niche with named industrial protocols is a clear, narrow domain with distinct triggers and minimal overlap risk with general appsec or other skills.	5 / 5
	Total	19 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
metadata_field	'metadata' should map string keys to string values	Warning

	Total	14 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/ics/SKILL.md
Commit: 0cf691e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.