CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

mfa-fatigue-social

MFA fatigue (push-bombing) combined with help-desk impersonation — overwhelm the target with repeated MFA push notifications and then social-engineer them into approving via a vishing call posing as IT support.

Quality

77%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/phisher/mfa-fatigue-social/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

71%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A dense, actionable single-file skill with executable multi-IdP code, good error handling, and a clear decision gate. Its main structural weakness is monolithic inline content with no progressive disclosure via bundle files, plus light redundancy between the OPSEC and error-handling sections.

Suggestions

Move per-provider push-trigger scripts (Entra, Okta, Duo) into references/ (e.g. references/entra-push.md, references/okta-push.md) and keep a one-line summary plus link per provider in SKILL.md.

Replace the comment-only caller-ID spoofing block with an actual executable example or remove it in favor of a reference.

Merge duplicate lockout/rate-limit guidance from OPSEC and Error Handling into one section to reclaim tokens.

DimensionReasoningScore

Conciseness

Mostly lean: executable code, compact tables, and a tight decision gate with little concept padding. Minor redundancy between the OPSEC and Error Handling sections (lockout advice restated) and slightly conversational timing rationale keep it below 5.

4 / 5

Actionability

Concrete, executable Python and curl for Entra, Okta, and Duo with real error-code checks (AADSTS50076/50053), plus verbatim call scripts and a number-matching relay dialog. The caller-ID-spoofing block is comment-only with no executable command, a minor gap.

4 / 5

Workflow Clarity

Clear sequence (prerequisites → trigger → timing → vishing → fallbacks) with an explicit Decision Gate and abort checkpoints (lockout, Duo Fraud button, number-matching enforcement). The batch-operation cap does not bind because error-code validation and abort conditions are present, though recovery loops beyond 'abort and switch target' are thin.

4 / 5

Progressive Disclosure

No bundle files exist; ~300 lines of per-provider code, detection signatures, and call scripts are all inlined in a single SKILL.md. Sections are well-organized, but content that clearly belongs in references/ (per-IdP trigger scripts, SIM-swap procedure) is inline, matching the 'could be better organized' anchor.

3 / 5

Total

15

/

20

Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A highly specific, distinctive description that names the exact attack mechanics in third person. Its main gap is the absence of an explicit 'Use when...' trigger clause in the description itself, capping completeness at 3 despite strong keywords elsewhere in the frontmatter.

Suggestions

Append an explicit trigger clause to the description, e.g. 'Use when valid credentials are blocked by MFA and the engagement scope covers vishing or push-based MFA bypass.'

Fold one or two natural user phrases from metadata.when_to_use (e.g. 'MFA bypass', 'push bombing') into the description so trigger matching does not depend on the separate metadata field.

DimensionReasoningScore

Specificity

The description lists multiple concrete actions in third person — 'overwhelm the target with repeated MFA push notifications and then social-engineer them into approving via a vishing call posing as IT support' — covering the full mechanism (trigger, fatigue, approval vector) with comprehensive, non-generic coverage.

5 / 5

Completeness

The 'what' is clearly answered, but the description contains no 'Use when...' clause or equivalent explicit trigger guidance; trigger terms exist only in a separate metadata field, so completeness is capped at 3 per the rubric.

3 / 5

Trigger Term Quality

Good natural keyword coverage: 'MFA fatigue (push-bombing)', 'push notifications', 'help-desk impersonation', 'vishing', 'IT support'. A few natural terms a user might say are missing ('MFA bypass', provider names like Okta/Duo/Entra), which live in the separate when_to_use metadata rather than the description.

4 / 5

Distinctiveness Conflict Risk

Clear niche combining push-bombing with concurrent help-desk vishing; trigger phrases are distinct from generic phishing or credential-harvest skills, so conflict risk is minimal.

5 / 5

Total

17

/

20

Passed

Validation

87%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

metadata_field

'metadata' should map string keys to string values

Warning

Total

14

/

16

Passed

Repository

PurpleAILAB/Decepticon

Path

packages/decepticon/decepticon/skills/standard/phisher/mfa-fatigue-social/SKILL.md

Revision

49888ee

Reviewed

Table of Contents

DiscoveryImplementationValidation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.

Claim skill