linux-privesc-enum

Systematic Linux privilege-escalation enumeration methodology — ordered phases covering sudo, SUID/SGID, capabilities, cron, writable paths, NFS, kernel CVEs, and GTFOBins lookup, grounded in LLM-assisted autonomous privesc research (hackingBuddyGPT/ipa-lab).

Quality

73%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/post-exploit/linux-privesc-enum/SKILL.md

Quality

Content

72%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable with comprehensive executable examples and a clear phased workflow. Its weaknesses are the lack of explicit validation/rollback checkpoints for destructive operations and the absence of progressive disclosure, with all material inlined in a single long file.

Suggestions

Add explicit validation/rollback checkpoints before destructive writes — e.g. back up /etc/passwd and /etc/sudoers before overwriting, and verify the new account works before relying on it.

Split the per-phase exploit recipes and the CVE reference table into one-level-deep reference files (e.g. references/exploits.md, references/cves.md) with clearly signaled links from SKILL.md.

Tighten the few narrative asides (e.g. 'Sudo misconfigurations are the most common finding in CTFs and enterprise systems alike') to keep the body lean.

Dimension	Reasoning	Score
Conciseness	The body is dense, executable bash with minimal padding and mostly assumes Claude's competence; a few explanatory asides (e.g. 'Sudo misconfigurations are the most common finding...') could be trimmed but overall it is efficient.	4 / 5
Actionability	It provides fully executable, copy-paste-ready commands and payloads across all phases — concrete sudo/SUID/capability exploit one-liners, an LD_PRELOAD C payload, passwd/sudoers overwrite, and wildcard injection — covering the common cases comprehensively.	5 / 5
Workflow Clarity	An explicit 8-phase ordered sequence with a decision-flow diagram exists and instructs to 'stop at first exploitable finding and validate before moving to the next phase', but destructive operations (overwriting /etc/passwd, /etc/sudoers, LD_PRELOAD injection) lack explicit validation/rollback checkpoints, so workflow clarity is capped at 3.	3 / 5
Progressive Disclosure	The skill is well-organized into per-phase section headers, but everything is inlined in a ~400-line SKILL.md with no bundle files; substantial content (per-phase exploit recipes, CVE reference, GTFOBins mappings) that belongs in one-level-deep reference files is inline, and no references are signaled.	3 / 5
	Total	15 / 20 Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and distinct, naming concrete enumeration phases and tools that clearly scope the skill. Its main weakness is the absence of an explicit 'Use when...' trigger clause, leaving the invocation context only implied.

Suggestions

Add an explicit trigger clause such as 'Use when performing Linux privilege escalation enumeration, checking sudo/SUID/capabilities/cron/NFS, or looking up GTFOBins exploitation paths.'

Include a couple of natural user synonyms (e.g. 'privesc', 'priv esc', 'linpeas') to broaden trigger-term coverage.

Dimension	Reasoning	Score
Specificity	The description enumerates concrete coverage areas — 'ordered phases covering sudo, SUID/SGID, capabilities, cron, writable paths, NFS, kernel CVEs, and GTFOBins lookup' — which is comprehensive and specific rather than vague.	5 / 5
Completeness	The 'what' is clear (a systematic ordered enumeration methodology), but there is no explicit 'Use when...' trigger clause; the 'when' is only weakly implied by the listed topics, so completeness is capped per the missing-trigger guidance.	3 / 5
Trigger Term Quality	Natural terms like 'Linux privilege-escalation enumeration', 'sudo', and 'GTFOBins' appear, but coverage of common synonyms/variations a user would say is slightly short of comprehensive (e.g. no 'privesc', 'linpeas', 'priv esc').	4 / 5
Distinctiveness Conflict Risk	It targets a clear niche — Linux privilege-escalation enumeration with named phases and tools (GTFOBins, NFS, capabilities) — making it unlikely to trigger for unrelated skills.	5 / 5
	Total	17 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/post-exploit/linux-privesc-enum/SKILL.md
Commit: 31e1c8e

Reviewed: 20 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.