Tessl • The management layer for AI agent skills

SkillPublic

network-replay

PCAP-based network replay attacks: capture auth sequences, session tokens, and protocol frames, then replay or inject to achieve unauthorized access or session hijack.

Quality

77%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/post-exploit/network-replay/SKILL.md

Quality

Content

78%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-sequenced offensive playbook with concrete, executable commands across all major replay techniques. Its weaknesses are moderate: no validation checkpoints between phases, and everything lives in one monolithic SKILL.md body rather than being split into reference files.

Suggestions

Split protocol-specific detail (Kerberos PTT, NTLM relay, MQTT replay, TCP hijack) into references/ files and keep SKILL.md as a phase overview with clearly signaled one-level-deep pointers.

Add explicit validation checkpoints between phases, e.g., verify the capture contains a complete auth exchange before replaying, and confirm a token is still live (low-cost probe request) before committing to full replay.

Trim the Overview paragraph and the JWT note to bare operational statements.

Dimension	Reasoning	Score
Conciseness	Mostly terse header-plus-command structure with no educational filler; minor over-explanation in the Overview paragraph and the JWT "note: this does NOT forge" aside could be trimmed. Efficient but not perfectly lean, so 4.	4 / 5
Actionability	Near copy-paste-ready tcpdump/tshark/tcprewrite/tcpreplay/curl/responder commands and runnable scapy snippets spanning the common cases (HTTP cookies, JWT, Kerberos PTT, NTLM relay, MQTT, TCP hijack). Placeholders like <iface> are operator inputs, and the one illustrative index (packets[5]) is commented.	5 / 5
Workflow Clarity	Phases 1-4 give an explicit capture -> extract -> replay -> hijack sequence plus an upfront tool-availability check. Validation checkpoints are implicit rather than stated (e.g., no step to confirm the capture contains a complete auth exchange or that a token is still live before replaying), keeping it below 5.	4 / 5
Progressive Disclosure	Well-sectioned single file, but ~265 lines of protocol-specific detail (Kerberos PTT, NTLM relay, MQTT, TCP hijack) are inlined in SKILL.md with no bundle files to offload them; the sole reference (ad/ntlm-relay) points outside the bundle. Structure is good but content that would fit reference files is inline, matching the 3 anchor.	3 / 5
	Total	16 / 20 Passed

Description

66%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A tight, concrete one-sentence description that clearly states what the skill does and names its niche. Its main weakness is that the "when to use" triggers are confined to a separate metadata.when_to_use field instead of the description itself, capping completeness and slightly limiting natural trigger coverage.

Suggestions

Append a "Use when..." clause to the description itself (e.g., "Use when replaying captured traffic, tokens, or tickets, or when the user mentions tcpreplay, scapy, Pass-the-Ticket, or token replay") rather than keeping triggers only in metadata.when_to_use.

Fold 2-3 of the most natural trigger phrases from metadata.when_to_use (token replay, session hijacking, kerberos ticket replay) into the description to improve trigger term coverage.

Mention the extraction step between capture and replay so the capability list reads comprehensively.

Dimension	Reasoning	Score
Specificity	Lists several concrete actions ("capture auth sequences, session tokens, and protocol frames, then replay or inject") with a concrete goal ("unauthorized access or session hijack"). Not 5 because the extraction step between capture and replay is only implied, leaving a minor coverage gap.	4 / 5
Completeness	The "what" is clear and specific, but the description field contains no "Use when..." clause or equivalent trigger guidance; the when-to-use text sits in a separate metadata field, so completeness is capped at 3 per the judging guideline.	3 / 5
Trigger Term Quality	Includes natural phrases users would say ("network replay attacks", "PCAP", "session tokens", "session hijack") but omits common synonyms and tool names (token replay, cookie, tcpreplay, scapy) that live only in the metadata.when_to_use field.	4 / 5
Distinctiveness Conflict Risk	"PCAP-based network replay attacks" carves a clear niche distinct from generic capture or credential skills, though "session hijack" could overlap with a dedicated hijacking skill. Minor overlap risk, so 4 rather than 5.	4 / 5
	Total	15 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/post-exploit/network-replay/SKILL.md
Revision: 49888ee

Reviewed: 25 days ago

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.

network-replay

Table of Contents

Is this your skill?