CtrlK
BlogDocsLog inGet started
Tessl Logo

lockbit

LockBit / generic RaaS-affiliate adversary-emulation playbook — broker/edge/RDP initial access, beacon, AD compromise to Domain Admin, defense evasion (Defender-disable via GPO, shadow-copy deletion), bulk exfil, then canary double-extortion encryption (Windows + ESXi). Reusable template for any ransomware affiliate (ALPHV, Akira, Black Basta). Triggers on: 'emulate LockBit', 'ransomware affiliate', 'RaaS', 'double extortion', 'StealBit', 'domain-wide ransomware', 'ESXi locker'.

71

Quality

87%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

SKILL.md
Quality
Evals
Security

Quality

Content

75%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a well-structured, actionable adversary-emulation playbook with concrete kill-chain mapping and strong safety gating for its destructive operations. It is held back from top marks only by minor time-sensitive CTI verbosity, implicit rather than explicit validation feedback loops, and external references that cannot be verified against a bundle.

Suggestions

Move or isolate the dated CTI claims ('most prolific RaaS of 2022-2023', 'Operation Cronos in Feb 2024') into a 'CTI snapshot / may drift' note so the main flow stays evergreen and maximizes conciseness.

Add an explicit validation feedback loop for the destructive steps (e.g., 'after gating defense evasion, confirm canary-only scope before mass deployment; if scope check fails, abort and re-verify') rather than relying on the implicit deconfliction record.

Either add a references/ bundle file for apt-groups.md or reword the in-body pointers so navigation targets are unambiguous and verifiable within the skill bundle.

DimensionReasoningScore

Conciseness

Lean and assumes Claude's competence — MITRE TTPs are named without explanation and there is no concept padding — but time-sensitive CTI phrasing ('most prolific RaaS of 2022-2023, disrupted by Operation Cronos in Feb 2024') is not isolated in a deprecated section, which the rubric flags. Not a 5 due to that minor time-sensitive verbosity; not a 3 because the body is otherwise efficient.

4 / 5

Actionability

A concrete kill-chain table maps each phase to MITRE, an emulated action, and a specific executing-agent skill path, plus a copy-paste ThreatProfile JSON seed and numbered CONOPS — mostly executable guidance. Minor gaps: the referenced paths point to other skills rather than inline commands, so not fully copy-paste ready.

4 / 5

Workflow Clarity

The kill chain is clearly sequenced via the 10-phase table and numbered CONOPS, and destructive steps have explicit safety gates (lab/canary-only markers, an EMERGENCY abort, deconfliction recording). Not a 5 because the validate-fix-retry loop is only implicit via cleanup/deconfliction rather than an explicit re-check step.

4 / 5

Progressive Disclosure

A single self-contained body with well-organized section headers; the two apt-groups.md references are clearly signaled one-level-deep pointers. Not a 5 because those references point outside this skill's bundle (no references/ dir exists to verify), leaving minor navigation ambiguity.

4 / 5

Total

16

/

20

Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is exemplary: concrete actions, comprehensive natural trigger terms, and explicit what/when guidance in a distinctive niche. It is dense but every clause earns its place and the third-person voice is correct.

DimensionReasoningScore

Specificity

Lists multiple concrete actions — 'broker/edge/RDP initial access, beacon, AD compromise to Domain Admin, defense evasion (Defender-disable via GPO, shadow-copy deletion), bulk exfil, then canary double-extortion encryption (Windows + ESXi)' — with comprehensive coverage of the kill chain.

5 / 5

Completeness

Clearly states both what the skill does (full double-extortion kill-chain playbook) and when to use it (explicit trigger phrase list), matching the top anchor.

5 / 5

Trigger Term Quality

Explicit 'Triggers on:' clause provides natural phrases a user would say ('emulate LockBit', 'ransomware affiliate', 'RaaS', 'double extortion', 'StealBit', 'domain-wide ransomware', 'ESXi locker') plus actor synonyms.

5 / 5

Distinctiveness Conflict Risk

Occupies a highly specific niche — RaaS-affiliate ransomware emulation — with distinct triggers and minimal overlap risk with other skills; written in third person.

5 / 5

Total

20

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

Total

15

/

16

Passed

Repository
PurpleAILAB/Decepticon
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.