network-replay

PCAP-based network replay attacks: capture auth sequences, session tokens, and protocol frames, then replay or inject to achieve unauthorized access or session hijack.

Quality

83%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

76%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable with broad executable coverage of replay techniques and is well-structured, but it lacks the validation/verification checkpoints that a destructive network-attack workflow requires, which caps its workflow-clarity score.

Suggestions

Add explicit validation checkpoints between phases, e.g., 'Verify the captured PCAP contains the target auth exchange (tshark -r capture.pcap -Y http.cookie) before proceeding to replay.'

Add a success-verification step after replay (e.g., confirm the replayed token grants access with an authenticated request) before recording the finding.

Consider splitting the protocol-specific extraction sections (Kerberos, NTLM, MQTT) into reference files to reduce the density of the main document and improve navigation.

Dimension	Reasoning	Score
Conciseness	The body is largely lean — command snippets and code blocks with terse commentary and no tutorials on concepts Claude already knows — but a few explanatory lead-ins and OPSEC rationales are slightly more than strictly necessary and could be trimmed.	4 / 5
Actionability	Extensive copy-paste-ready commands and scripts (tcpdump/tshark filters, tcpreplay/tcprewrite, scapy injection, curl replay, mosquitto_pub, Rubeus/impacket) cover the common cases across HTTP, JWT, Kerberos, NTLM, and MQTT.	5 / 5
Workflow Clarity	Four phases are clearly sequenced, but this destructive/network skill has no validation checkpoints (e.g., verify captured auth frames before replay, confirm token validity before reuse, verify replay succeeded), which caps workflow clarity at 3 per the rubric's destructive-operations rule.	3 / 5
Progressive Disclosure	No bundle files exist, but the single document is well-organized into clear sections (Overview, Tool inventory, Phases 1-4, ATT&CK, Evidence, Anti-replay, OPSEC) with a clearly signaled inline cross-reference to ad/ntlm-relay; some protocol-specific blocks could be split out for cleaner navigation.	4 / 5
	Total	16 / 20 Passed

Description

91%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, distinctive, and well-supplied with comprehensive trigger terms via when_to_use metadata. The main weakness is that the 'when to use' guidance is in metadata rather than woven into the description prose itself.

Suggestions

Add an explicit 'Use when ...' clause to the description prose so trigger guidance is integrated rather than only present in metadata.when_to_use.

Include a few natural-language synonyms the user might say (e.g., 'session hijack', 'token replay') directly in the description sentence for self-contained discoverability.

Dimension	Reasoning	Score
Specificity	The description lists multiple concrete actions across capture and replay phases — 'capture auth sequences, session tokens, and protocol frames, then replay or inject to achieve unauthorized access or session hijack' — providing comprehensive coverage of the skill's capabilities.	5 / 5
Completeness	The 'what' is clearly stated in the description prose, and an explicit 'when' is present via the when_to_use metadata, but the trigger guidance lives in metadata rather than being integrated into the description itself, so it could be more explicit.	4 / 5
Trigger Term Quality	The frontmatter's when_to_use metadata supplies comprehensive natural trigger terms including synonyms and tool names ('replay attack, pcap replay, session hijack, token replay, tcpreplay, scapy replay, kerberos ticket replay, jwt replay, oauth replay, NTLM relay capture replay, credential replay, MQTT frame replay, sequence number prediction').	5 / 5
Distinctiveness Conflict Risk	'PCAP-based network replay attacks' with specific primitives (session hijack, token replay, Kerberos PTT, JWT replay, MQTT) carves a clear niche with minimal overlap risk against other skills.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/post-exploit/network-replay/SKILL.md
Commit: 31e1c8e

Reviewed: 23 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.