network-replay

PCAP-based network replay attacks: capture auth sequences, session tokens, and protocol frames, then replay or inject to achieve unauthorized access or session hijack.

Quality

66%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/post-exploit/network-replay/SKILL.md

Quality

Content

65%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable with executable commands and code across a clear four-phase workflow, but it is a monolithic inline document that lacks validation feedback loops for risky replay operations and does not split detail into referenced bundle files.

Suggestions

Add explicit validation/checkpoint steps before replay execution (e.g. confirm captured token validity, verify rewrite correctness, test replay against a safe target before full speed), with fix-and-retry feedback loops.

Move protocol-specific deep dives (Kerberos PTT, NTLM relay, MQTT replay) into separate reference files under references/ and keep SKILL.md as a concise overview with one-level-deep, clearly signaled links.

Dimension	Reasoning	Score
Conciseness	The body is mostly efficient and action-oriented, but includes some unnecessary explanatory asides Claude already knows (e.g. 'Decode and inspect without verification (note: this does NOT forge — just inspects claims...)') and mild padding; it fits the level-2 'mostly efficient but could be tightened' anchor and is not the level-3 lean-every-token-earns-its-place ideal.	2 / 3
Actionability	Provides fully executable, copy-paste-ready commands and code throughout (tcpdump, tshark field extraction, scapy injection, curl replay, mosquitto_pub), matching the 'fully executable code/commands; copy-paste ready' anchor and clearly above the level-2 pseudocode anchor.	3 / 3
Workflow Clarity	The four-phase sequence (Capture -> Extract -> Replay -> Hijack) is clearly laid out, but destructive/batch operations like tcpreplay replay and session injection lack explicit validate-then-proceed checkpoints and error-recovery feedback loops, so per the rubric's feedback-loop note workflow clarity is capped at 2 rather than 3.	2 / 3
Progressive Disclosure	The body is a single inline monolith of phases with one inline pointer ('See ad/ntlm-relay for full relay playbook') rather than a concise overview with well-signaled one-level-deep reference files; no bundle files exist to split the detail, fitting the level-2 'structure present but content that should be separate is inline' anchor and short of the level-3 overview-with-references pattern.	2 / 3
	Total	9 / 12 Passed

Description

67%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and well-differentiated with concrete capture/replay actions, but it omits an explicit 'Use when...' trigger clause, which caps completeness and limits trigger-term naturalness.

Suggestions

Add an explicit 'Use when...' clause naming natural trigger phrases (e.g. 'Use when replaying captured network traffic, reusing session tokens or cookies, or performing session hijacking').

Broaden trigger terms with common user-facing synonyms alongside the technical jargon (e.g. 'session hijack, cookie/token reuse, replaying a packet capture').

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'capture auth sequences, session tokens, and protocol frames, then replay or inject' — matching the 'Lists multiple specific concrete actions' anchor, and is clearly above the level-2 anchor which names a domain and some actions only.	3 / 3
Completeness	It clearly answers 'what does this do' but provides no explicit 'Use when...' / 'when should Claude use it' clause, so per the rubric a missing trigger clause caps completeness at 2; it is above level 1 because the 'what' is strong and specific.	2 / 3
Trigger Term Quality	Includes relevant technical terms (PCAP, replay, session hijack, protocol frames) but leans on jargon rather than the natural variations a user would say (e.g. 'session hijack' is good, but the phrase is terse and omits common synonyms); it has some relevant keywords but is missing common variations, fitting the level-2 anchor and falling short of the broad natural-term coverage at level 3.	2 / 3
Distinctiveness Conflict Risk	The niche is sharp and unlikely to trigger for the wrong skill — 'PCAP-based network replay attacks ... session hijack' is a distinct, narrowly-scoped primitive — matching the 'clear niche with distinct triggers' anchor and clearly above the level-2 'could still overlap' anchor.	3 / 3
	Total	10 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/post-exploit/network-replay/SKILL.md
Commit: e34afba

Reviewed: 6 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.