kali-mcp-bridge

Deploy and drive Kali Linux tools via MCP-Kali-Server — structured tool-call interface, SSH tunnel setup, prompt-injection hygiene for AI-assisted engagements.

Quality

67%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/decepticon/kali-mcp-bridge/SKILL.md

Quality

Content

72%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable with concrete, executable guidance and a clear phased workflow, but it is a monolithic single-file skill with no progressive disclosure of detail, and its destructive/batch phases lack explicit feedback-loop checkpoints.

Suggestions

Add explicit validate→fix→retry feedback loops for the destructive/batch phases — e.g. after sqlmap_scan, check `success`/output for findings and retry with raised --level/--risk before moving on; after hydra, verify cracked credentials before reuse.

Move the bulk of the tool-call reference (sections 3.1–3.10) into a references/ file (e.g. TOOL_REFERENCE.md) and keep SKILL.md as an overview that points one level deep to it, improving progressive disclosure.

Trim the minor over-explanation in the troubleshooting table and a few explanatory sentences (e.g. clarifying self-evident JSON fields) to push conciseness toward the lean anchor-5.

Dimension	Reasoning	Score
Conciseness	The body is efficient and assumes competence — it does not explain what nmap or SQL injection are — with only minor over-explanation, e.g. troubleshooting rows elaborate self-evident fields; not quite the lean anchor-5.	4 / 5
Actionability	Concrete, copy-paste-ready guidance throughout: executable deployment and SSH-tunnel commands, an MCP-registration JSON snippet, per-tool parameter signatures, and worked phase examples covering the common engagement cases.	5 / 5
Workflow Clarity	A clear six-phase sequence exists with some validation (server_health check, 'Parse output; extract open ports'), but destructive/batch operations (hydra, sqlmap, metasploit) lack explicit validate→fix→retry feedback loops, which the rubric caps at 3.	3 / 5
Progressive Disclosure	Internal section structure is good (numbered sections, tables, code blocks) but the skill is a single monolithic file with the entire tool-call reference and troubleshooting bulk inlined and no bundle files in references/scripts/assets to offload detail.	3 / 5
	Total	15 / 20 Passed

Description

62%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and distinctive, naming concrete actions and a clear niche, but it omits an explicit 'Use when…' trigger clause and only partially surfaces the natural keywords a user would say, which limits completeness and trigger-term quality.

Suggestions

Add an explicit 'Use when…' clause naming concrete trigger situations (e.g. 'Use when driving Kali tools through an MCP bridge during an authorized engagement, setting up SSH-tunneled tool access, or hardening against prompt injection from tool output').

Expand natural-language trigger terms inside the description itself — include synonyms like 'Kali Linux tools', 'penetration testing assistant', 'MCP tool execution', and 'red-team automation' rather than relying on metadata.when_to_use.

Tighten the action list toward the anchor-5 level by enumerating the wrapped capabilities (nmap, sqlmap, hydra, etc.) so coverage is comprehensive, not just representative.

Dimension	Reasoning	Score
Specificity	Lists several concrete actions — 'Deploy and drive Kali Linux tools via MCP-Kali-Server', 'structured tool-call interface', 'SSH tunnel setup', 'prompt-injection hygiene' — with only minor coverage gaps versus the comprehensive anchor-5.	4 / 5
Completeness	It clearly answers 'what' (deploy/drive Kali tools via MCP, SSH tunneling, injection hygiene) but has no explicit 'Use when…' trigger clause; per the rubric a missing trigger clause caps completeness at 3.	3 / 5
Trigger Term Quality	The description contains some natural terms ('mcp kali server', 'ai pentest', 'kali mcp bridge') but lacks the breadth of synonyms and variations users would naturally say; the fuller keyword set lives in metadata.when_to_use rather than the description itself.	3 / 5
Distinctiveness Conflict Risk	Names a clear, narrow niche (MCP-Kali-Server bridge for AI-assisted engagements) with distinct triggers and minimal overlap risk with other skills.	5 / 5
	Total	15 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/decepticon/kali-mcp-bridge/SKILL.md
Commit: 0cf691e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.