Tessl • The management layer for AI agent skills

Blog Docs Log inGet started

SkillPublic

open-redirect

Open redirect + tabnabbing — URL filter bypass, OAuth chain extension, phishing infrastructure-free, SSRF chain.

Quality

78%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/exploit/web/open-redirect/SKILL.md

Quality

Content

82%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A tight, high-signal offensive-security playbook: every section is operationally dense with payloads, a verification PoC, severity guidance, and remediation code, with essentially no padding. The main gaps are minor — a couple of schematic payloads and cross-references to files that don't exist in this bundle — rather than structural problems.

Dimension	Reasoning	Score
Conciseness	The body is a lean playbook: payload tables, parameter lists, terse chain diagrams, and a one-line severity matrix ("Standalone open redirect = Low/Informational by itself. Chained: critical"). Every section adds non-obvious operational detail and nothing explains concepts Claude already knows.	5 / 5
Actionability	Mostly copy-paste ready: an 18-row payload table with exact payloads, a working curl verification one-liner, named tools (OpenRedireX, gf, Burp Intruder), and executable Python for the defender section. Falls short of 5 because some entries are schematic — the CRLF payload is truncated with "...", and the path-traversal-in-fragment row is more illustrative than directly usable.	4 / 5
Workflow Clarity	The numbered sections form a coherent implicit flow — recon parameters (§1) → bypass payloads (§2) → chain patterns (§3) → tools (§4) → PoC confirmation (§5) → severity (§6) — and §5 provides an explicit verification checkpoint (grep the Location header). Not a 5 because the sequence is never framed as steps, there is no guidance on iterating payloads when one fails, and the defender section (§7) sits outside any stated workflow.	4 / 5
Progressive Disclosure	The skill is a single well-organized file with clear section headers, and the "Cross-references" section points one level deep to related skills. Not a 5 because those referenced paths (skills/exploit/web/oauth/SKILL.md, skills/_corpus/payloads/Open Redirect/) are not part of this bundle — no references/, scripts/, or assets/ directories exist — so the navigation targets are unverifiable, and the payload table plus chain details could live in a reference file for a leaner SKILL.md.	4 / 5
	Total	17 / 20 Passed

Description

66%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is terse and domain-specific with strong natural keywords, but it reads as a compressed fragment list rather than a well-formed capability statement. Its main weakness is the missing "Use when..." clause in the description field itself — trigger guidance is relegated to a metadata.when_to_use keyword list — and one phrase ("phishing infrastructure-free") is confusing rather than informative.

Suggestions

Add an explicit trigger clause to the description, e.g. "Use when auditing URL redirects, redirect_uri validation, or unvalidated forward/return parameters" — this lifts completeness from 3 toward 5.

Rewrite the cryptic fragment "phishing infrastructure-free" as a concrete capability such as "phishing via trusted-domain redirects".

Include common synonyms users would actually say — "unvalidated redirect", "redirect parameter", "return URL" — directly in the description rather than only in the metadata.when_to_use field.

Dimension	Reasoning	Score
Specificity	The description names several concrete capabilities — "URL filter bypass", "OAuth chain extension", "SSRF chain", "tabnabbing" — giving good coverage of the domain. It falls short of 5 because phrases like "phishing infrastructure-free" are cryptic fragments rather than clearly stated actions, and no verb-led phrasing clarifies what the skill actually does with these techniques.	4 / 5
Completeness	The "what" is clear (URL filter bypass and redirect-chaining into OAuth/SSRF/phishing), but the description field contains no "Use when..." clause or equivalent trigger guidance — that guidance lives in a separate metadata.when_to_use keyword list rather than the description. Per the rubric guideline, a description lacking an explicit when-clause is capped at 3; it is not a 2 because the what is specific and frontmatter metadata partially signals usage.	3 / 5
Trigger Term Quality	Natural terms a user would say when needing this skill are present: "open redirect", "tabnabbing", "URL filter bypass", "OAuth", "SSRF", "phishing". Not a 5 because common variations such as "unvalidated redirect", "redirect parameter", or "forward" are absent from the description itself (some appear only in the metadata.when_to_use field).	4 / 5
Distinctiveness Conflict Risk	A clear niche (open redirect exploitation and chaining) with distinct triggers like "tabnabbing" and "redirect_uri" minimizes conflict risk. Not a 5 because "SSRF" and "phishing" overlap with dedicated SSRF and phishing skills, so a query mentioning only SSRF could plausibly match this skill.	4 / 5
	Total	15 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/exploit/web/open-redirect/SKILL.md
Revision: 49888ee

Reviewed: 25 days ago

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.

open-redirect

Table of Contents

Is this your skill?