lure-deconfliction

Mandatory out-of-band handshake with the blue-team contact BEFORE any phishing campaign sends. Skipping this is a critical RoE violation - the engagement has no legal coverage for unannounced phishing of real employees.

Quality

71%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/phisher/lure-deconfliction/SKILL.md

Quality

Content

85%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a tight, well-sequenced operational runbook with strong validation gates and a clear evidence trail, weakened only by pseudocode in the ack-polling loop. Replacing the placeholder functions with real, executable checks would make it fully copy-paste ready.

Suggestions

Replace the pseudocode ack-poll loop with an executable implementation (e.g. a concrete signal-cli/IMAP query or a real shell condition) so the actionability dimension reaches copy-paste ready.

Specify how 'ack_received' is actually detected per ack_method (signal-cli message lookup, IMAP search, voice log entry) to remove ambiguity at the critical gate.

Dimension	Reasoning	Score
Conciseness	The body is lean and operational — payload templates, signal-cli commands, a poll loop, and a log format — with no padding explaining concepts Claude already knows; even the 'Why this is mandatory' section carries engagement-specific legal context that earns its tokens.	3 / 3
Actionability	The signal-cli command and payload template are concrete, but the poll loop relies on non-executable pseudocode functions ('ack_received', 'past_deadline', 'update_objective') rather than real commands, matching the 'pseudocode instead of executable code' anchor at 2 rather than fully copy-paste ready at 3.	2 / 3
Workflow Clarity	The process is explicitly sequenced (inputs → payload → send → wait for ack → record evidence) with hard validation checkpoints — the 13:45 KST no-ack deadline that blocks the send, the ZFP two-method evidence gate, and named failure-mode recovery loops — matching the clear-sequence-with-validation anchor.	3 / 3
Progressive Disclosure	No bundle files exist and the skill is a single self-contained file with well-organized, clearly titled sections and no nested references; the only paths referenced (plan/roe.json, deconfliction-log.md) are engagement artifacts, not skill-bundle hops, so it qualifies for the well-organized-single-file anchor at 3.	3 / 3
	Total	11 / 12 Passed

Description

57%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description conveys a sharp, distinctive niche and a concrete core action, but lacks an explicit 'Use when' trigger clause and leans on jargon over natural user phrasing. Adding natural trigger terms and a 'Use when...' clause would lift completeness and trigger quality.

Suggestions

Add an explicit 'Use when...' clause naming natural triggers such as 'Use when sending a phishing campaign, activating an evilginx2 phishlet, or launching a lure.'

Replace jargon ('RoE violation', 'out-of-band handshake') with user-facing phrasing while keeping the legal-mandatory warning.

List the concrete actions performed (notify blue-team contact, wait for ack, block on no-ack) so specificity reaches the multiple-actions anchor.

Dimension	Reasoning	Score
Specificity	Names a concrete domain (phishing campaign, blue-team contact) and a specific action ('handshake'), but does not enumerate multiple concrete actions, matching the 'names domain and some actions' anchor rather than the multiple-actions anchor at 3.	2 / 3
Completeness	It clearly states what the skill does (mandatory handshake) and implies timing ('BEFORE any phishing campaign sends'), but there is no explicit 'Use when...' trigger clause, which the guidelines cap at 2 rather than 1 because the 'what' is present.	2 / 3
Trigger Term Quality	'phishing campaign' is a natural user term, but 'out-of-band handshake', 'RoE violation', and 'legal coverage' are jargon; common trigger variations are missing, so it sits at 'some relevant keywords but missing common variations'.	2 / 3
Distinctiveness Conflict Risk	The deconfliction-before-phishing niche is highly specific with distinct triggers unlikely to collide with other skills, matching the 'clear niche with distinct triggers' anchor.	3 / 3
	Total	9 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/phisher/lure-deconfliction/SKILL.md
Commit: e34afba

Reviewed: 10 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.