imds-pivot

Pivot from SSRF or RCE to cloud Instance Metadata Service (IMDS) — extract IAM role creds, instance identity, user-data secrets.

Quality

70%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/cloud/imds-pivot/SKILL.md

Quality

Content

72%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is lean, well-structured, and largely actionable with concrete curl commands across AWS/GCP/Azure, but undefined helper functions and missing validation checkpoints for destructive credential operations keep it from full marks.

Suggestions

Define or remove the `metadata_endpoints()` helper and the `kg_add_node`/`kg_add_edge` functions, or link to the skill that defines them.

Add an explicit validation step after credential extraction (e.g. run `aws sts get-caller-identity` to confirm the creds work before promoting them).

Dimension	Reasoning	Score
Conciseness	The body is dense and assumes Claude's knowledge — no basic explanations of IMDS/SSRF — with lean tables and executable commands where every token earns its place.	3 / 3
Actionability	Most commands are copy-paste ready curl/jq snippets, but the undefined `metadata_endpoints()` helper and the `kg_add_node`/`kg_add_edge` promotion functions are referenced without definition, leaving key pieces incomplete.	2 / 3
Workflow Clarity	Numbered sections give a clear identify→extract→promote sequence, but credential extraction and knowledge-graph promotion are batch/destructive operations with no explicit validation checkpoint (e.g. verify creds before promoting), which caps the score at 2.	2 / 3
Progressive Disclosure	Well-organized into clear numbered sections with one-level, clearly signaled references ('see SSRF skill catalog', 'Pivot to aws-iam-enum/SKILL.md'); no deep nesting or monolithic wall.	3 / 3
	Total	10 / 12 Passed

Description

67%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and distinct, clearly conveying a cloud IMDS credential-extraction pivot, but it omits an explicit 'Use when...' trigger clause and lacks some common trigger-term variations a user might naturally say.

Suggestions

Add an explicit 'Use when...' clause, e.g. 'Use when you have SSRF, server-side fetch, or RCE on a cloud instance and want to extract credentials or secrets from the metadata endpoint.'

Broaden trigger terms to include natural phrasings like 'instance metadata service', '169.254.169.254', and 'cloud metadata'.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'Pivot from SSRF or RCE to cloud Instance Metadata Service (IMDS)' and 'extract IAM role creds, instance identity, user-data secrets' — matching the anchor for several specific concrete actions.	3 / 3
Completeness	The 'what' is strong, but 'when' is only implied via 'Pivot from SSRF or RCE' with no explicit 'Use when...' clause, which per the rubric caps completeness at 2.	2 / 3
Trigger Term Quality	Relevant keywords ('SSRF', 'RCE', 'IMDS', 'IAM role creds', 'user-data') are present but missing common variations a user might say ('metadata service', '169.254.169.254', 'cloud metadata'), so coverage is incomplete.	2 / 3
Distinctiveness Conflict Risk	The IMDS-pivot niche from SSRF/RCE is specific and unlikely to overlap with or trigger other skills.	3 / 3
	Total	10 / 12 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
metadata_field	'metadata' should map string keys to string values	Warning

	Total	14 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/cloud/imds-pivot/SKILL.md
Commit: e34afba

Reviewed: 8 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.