CtrlK
BlogDocsLog inGet started
Tessl Logo

lazarus

Lazarus Group (Hidden Cobra, DPRK RGB) adversary-emulation playbook — financially-motivated crypto/DeFi theft and supply-chain intrusion: fake-job social engineering, trojanized apps, wallet/key theft, and on-chain DeFi/bridge exploitation (testnet/fork only). Use when emulating DPRK financial actors against a crypto/exchange/DeFi target. Triggers on: 'emulate Lazarus', 'Hidden Cobra', 'DPRK crypto', 'AppleJeus', '3CX supply chain', 'DeFi bridge attack', 'crypto theft'.

73

Quality

91%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

SKILL.md
Quality
Evals
Security

Quality

Content

82%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A strong, actionable adversary-emulation playbook with concrete JSON, MITRE-mapped kill-chain routing, and explicit safety gates for risky on-chain operations; minor gains available in tightening prose and adding an explicit validate-retry loop.

Suggestions

Tighten the opening blockquote and 'When to emulate Lazarus' prose to lift conciseness toward lean/efficient.

Add an explicit validate→fix→retry feedback loop for the forked-mainnet PoC (e.g., 'run PoC, confirm canary balance drained, else re-sign against fork') to reach anchor-5 workflow clarity.

Consider splitting the fidelity/deviation notes into a short references file to reduce body density and improve progressive disclosure.

DimensionReasoningScore

Conciseness

Mostly efficient and substantive (CTI context, JSON seed, kill-chain table) with only minor prose that could be trimmed, e.g. the opening blockquote and 'When to emulate Lazarus' narrative.

4 / 5

Actionability

Copy-paste-ready JSON threat-profile seed, a kill-chain table mapping each phase to MITRE TTPs and concrete executing-agent skill paths, and explicit CONOPS steps — fully executable guidance.

5 / 5

Workflow Clarity

Clear numbered kill-chain sequence (11 phases, 5-step CONOPS) with explicit safety gates (testnet/fork-only, EMERGENCY abort, canary wallets), though a validate→fix→retry feedback loop is not spelled out as in the anchor-5 example.

4 / 5

Progressive Disclosure

Well-organized overview with clearly signaled one-level-deep delegation to sub-skills (table routes each phase to a /skills/standard path) and one external reference (../../references/apt-groups.md); no bundle files present, slightly dense body keeps it from a 5.

4 / 5

Total

17

/

20

Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

An excellent description: third-person voice, specific named actions, comprehensive natural trigger phrases, and explicit what/when guidance tied to a distinct DPRK financial-actor niche.

DimensionReasoningScore

Specificity

Lists multiple concrete actions — 'fake-job social engineering, trojanized apps, wallet/key theft, and on-chain DeFi/bridge exploitation' — giving comprehensive coverage of the playbook's capabilities.

5 / 5

Completeness

Explicitly answers both what (adversary-emulation playbook with named TTPs) and when ('Use when emulating DPRK financial actors against a crypto/exchange/DeFi target' with concrete trigger phrases).

5 / 5

Trigger Term Quality

Comprehensive natural trigger phrases ('emulate Lazarus', 'Hidden Cobra', 'DPRK crypto', 'AppleJeus', '3CX supply chain', 'DeFi bridge attack', 'crypto theft') plus 'Use when emulating DPRK financial actors against a crypto/exchange/DeFi target'.

5 / 5

Distinctiveness Conflict Risk

Clear niche (Lazarus/Hidden Cobra DPRK financial actors) with distinct, actor-specific triggers; minimal overlap risk with other skills.

5 / 5

Total

20

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

Total

15

/

16

Passed

Repository
PurpleAILAB/Decepticon
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.