CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

kali-mcp-bridge

Deploy and drive Kali Linux tools via MCP-Kali-Server — structured tool-call interface, SSH tunnel setup, prompt-injection hygiene for AI-assisted engagements.

Quality

79%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/decepticon/kali-mcp-bridge/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

82%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A strongly operational, executable skill body: copy-paste deployment commands with validation checkpoints, complete tool-call documentation, an unusually good prompt-injection hygiene section, and a concrete troubleshooting table. The only notable weaknesses are mild redundancy across sections and the absence of an explicit re-validation loop in error recovery.

DimensionReasoningScore

Conciseness

The body is dominated by commands, tables, and call signatures, and assumes Claude's competence (no 'what is nmap' or SSH-concept padding); the injection-hygiene framing is justified non-obvious operational content rather than fluff. It is not 5 because of minor trimmable redundancy: SSH-exposure guidance is repeated in §2b and §6, and §4's example calls partially restate §3's parameter signatures.

4 / 5

Actionability

Fully executable throughout: copy-paste-ready deployment commands (apt/git paths), a health check with expected JSON output, concrete SSH tunnel commands, a complete MCP registration JSON block, per-tool parameter specs with realistic flag examples, and a troubleshooting table with specific fixes. The examples cover the common cases (recon, web, SQLi, credentials, SMB), matching the top anchor; placeholders like <IP> are appropriate, not gaps.

5 / 5

Workflow Clarity

The deployment sequence is clearly ordered (server → health verification with expected output → tunnel → client registration) and tool usage begins with an explicit connectivity prerequisite plus a 'check success before using output' rule and an injection halt-and-report checkpoint. It is not 5 because recovery from troubleshooting fixes lacks an explicit re-validation loop (e.g. re-run the health check after applying a fix), and §4 explicitly disclaims being a sequenced workflow, leaving the engagement-side flow loosely ordered.

4 / 5

Progressive Disclosure

The skill is a single well-organized file with numbered sections, clear headers, and no nested references; navigation is easy and nothing is buried. The anchor-5 'well-signaled one-level-deep references' pattern is not met because there are no reference files at all — the ~90-line tool-call reference in §3 is inline content that could arguably live in a separate reference file, but it is needed at every call so inline placement is defensible. This lands on the 'good structure; most content appropriately placed; minor organization gaps' anchor.

4 / 5

Total

17

/

20

Passed

Description

70%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A specific, well-targeted description that names concrete capabilities in a distinct niche, held back primarily by the absence of an explicit 'Use when...' trigger clause — the heaviest-weighted dimension. Tool-level specificity and natural trigger variants (present only in metadata, not the description) are the secondary gaps.

Suggestions

Add an explicit 'Use when...' clause to the description, e.g. "Use when bridging Kali tools through an MCP server during authorized pentest engagements, or when the user mentions MCP-Kali-Server, kali mcp, or AI-assisted pentesting" — this directly lifts the completeness score past its current cap of 3.

Name a few of the concrete tools driven (nmap, sqlmap, metasploit, hydra, gobuster) in the description to close the coverage gap and add natural trigger terms users would actually say.

Fold one or two natural trigger synonyms from the metadata when_to_use field (e.g. "kali mcp", "ai pentest") into the description itself so the trigger surface does not depend on a non-standard metadata field.

DimensionReasoningScore

Specificity

The description lists several concrete, verb-led actions — "Deploy and drive Kali Linux tools", "structured tool-call interface", "SSH tunnel setup", "prompt-injection hygiene" — matching the 'several specific actions; minor gaps in coverage' anchor. It falls short of 5 because it never names the actual tools it drives (nmap, sqlmap, hydra, metasploit, etc.), leaving coverage of its capability surface incomplete.

4 / 5

Completeness

The 'what' is clearly stated (deploy/drive Kali tools via MCP-Kali-Server with tunnel setup and injection hygiene), but there is no 'Use when...' clause or equivalent explicit trigger guidance — "for AI-assisted engagements" is only a weak contextual hint, not a when-to-use trigger. Per the judging guidelines, a missing 'Use when...' clause caps completeness at 3; it is not 2 because the 'what' is concrete and comprehensive, and not 4 because 'when' is absent rather than merely under-specified.

3 / 5

Trigger Term Quality

Natural terms a user would say are present: "Kali Linux tools", "MCP-Kali-Server", "MCP", "SSH tunnel", "AI-assisted engagements". This is good keyword coverage per the anchor-4 example, but a few natural variations users would actually type ("kali mcp", "ai pentest", "run nmap via mcp") are missing — they exist only in the frontmatter metadata's when_to_use field, not in the description itself.

4 / 5

Distinctiveness Conflict Risk

The description carves out a clear niche — driving Kali tools through the specific MCP-Kali-Server bridge — with distinct triggers ("MCP-Kali-Server", "Kali Linux tools", "MCP"). It would not be confused with PDF/document, general tunneling, or generic pentest skills, satisfying the 'clear niche with distinct triggers; minimal conflict risk' anchor; the 4 anchor's 'minor overlap risk with closely related skills' does not fit better.

5 / 5

Total

16

/

20

Passed

Validation

87%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

metadata_field

'metadata' should map string keys to string values

Warning

Total

14

/

16

Passed

Repository

PurpleAILAB/Decepticon

Path

packages/decepticon/decepticon/skills/standard/decepticon/kali-mcp-bridge/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.