CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

open-web

Resilient public-page reading and OSINT keyword search — web_search (allowlisted-provider OSINT) and web_fetch (curl_cffi TLS-impersonation grid + headless-browser fallback that gets past WAF/403/anti-bot). Use when a fetch is blocked, a page is JS-rendered, or you need open-web OSINT about a target/org.

Quality

91%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Low

Low-risk findings worth noting

SKILL.md
Quality
Evals
Security

Quality

Content

88%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-crafted operational skill body: it teaches only sandbox-engine specifics Claude cannot know, gives exact knobs and failure-handling loops, and includes explicit validation discipline (trust the verdict line, never raw status). The two soft spots are rhetorical asides that add tokens without guidance, and a ~90-line single-file layout whose fast-path table and engine internals could be offloaded to a one-level-deep reference file.

Suggestions

Trim rhetorical asides ("This is the whole point of the engine…", "(the discipline that matters)", "If it still fails, that is a real wall") to cut tokens without losing any operational guidance.

Move the platform fast-path table and the curl_cffi/headless escalation-ladder internals into a references/ file (e.g. references/platforms.md), keeping SKILL.md a lean overview with a clearly signaled one-level-deep pointer.

Fold the duplicated 'trust the verdict' guidance in R2 and R6 into one place to avoid restating the validation rule.

DimensionReasoningScore

Conciseness

The body is dense with engine-specific operational detail Claude cannot know elsewhere (verdict lines, stop_reason semantics, escalation ladder, RoE gating) — no filler explanations of concepts Claude already knows. However, rhetorical asides could be trimmed: quotes: "This is the whole point of the engine: the cheap path failing is the *start* of escalation, not permission to stop", "(the discipline that matters)", "If it still fails, that is a real wall". Not a 3: there are no padded sections or unnecessary concept explanations; not a 5: the editorializing flourishes are tokens that don't instruct.

4 / 5

Actionability

Concrete, executable guidance throughout. Quotes: "Always pass a `selector` (e.g. `article`, `#content`, `[class*='product']`)", "Retry once with `device=\"mobile\"`", "`web_search(\"site:reddit.com <topic>\")` first, then `web_fetch` the result URLs", plus a fast-path table giving exact URL forms for Reddit, X, YouTube, GitHub, npm, and PyPI covering the common cases. Not a 4: for the user-driven parts (the only knobs being selector and device), the instructions leave no gaps. Code absence is not penalized per the instruction-only scoring note.

5 / 5

Workflow Clarity

Clear sequenced workflow with explicit validation checkpoints and feedback loops. Quotes: "Typical flow: web_search to find a URL → web_fetch to read it", "Trust the tool's verdict / [web_fetch OK|FAILED] line, never a raw status", and the R6 failure loop: terminal stop_reasons (auth_required, not_found) mean move on, everything else gets a retry with device="mobile"/a precise selector, and "rate_limited (429) is NOT terminal — back off, then retry". Not a 4: validation and error-recovery checkpoints are explicit, not merely present.

5 / 5

Progressive Disclosure

Single-file skill (no references/, scripts/, or assets/ exist) with well-organized sections: tool overview, escalation ladder, verdict validation, failure handling, RoE boundary, and a fast-path table. Quotes: section headers "How web_fetch escalates", "R2 — HTTP 200 is NOT success", "R6 — a give-up is NOT exhaustion", "Platform fast-paths". Not a 5: the body is ~90 lines (over the 50-line simple-skill threshold) with all detail — the platform fast-path table and escalation-ladder internals border on reference material that could live one level deep. Not a 3: structure is clear and nothing is buried or misplaced for its size.

4 / 5

Total

18

/

20

Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description: it names both tools, their concrete mechanisms (TLS impersonation grid, headless-browser fallback), and an explicit, multi-trigger 'Use when' clause. Third-person voice is maintained and trigger terms are natural for the OSINT/recon domain; the only gap is a few missing everyday synonyms such as 'scrape' or 'captcha'.

DimensionReasoningScore

Specificity

Quotes: "Resilient public-page reading and OSINT keyword search", "web_search (allowlisted-provider OSINT)", "web_fetch (curl_cffi TLS-impersonation grid + headless-browser fallback that gets past WAF/403/anti-bot)". These are multiple specific concrete actions (keyword OSINT search, resilient page reading, TLS-impersonation fetching, browser fallback) with comprehensive coverage of both tools' capabilities. Not a 4: coverage is comprehensive across both tools with mechanisms and outcomes, not 'several actions with minor gaps'. Not lower: no vague fluff or pure abstraction.

5 / 5

Completeness

Quotes: an explicit "Use when a fetch is blocked, a page is JS-rendered, or you need open-web OSINT about a target/org" clause with three concrete trigger phrases, paired with a clear 'what' naming both tools and their mechanisms. Both 'what' and 'when' are clearly and explicitly answered. Not a 4: the 'when' is already explicit and specific, not 'could be more explicit'.

5 / 5

Trigger Term Quality

Quotes: "Use when a fetch is blocked, a page is JS-rendered, or you need open-web OSINT about a target/org" and "WAF/403/anti-bot". Natural phrases like "blocked", "JS-rendered", "OSINT", "WAF", "403" are terms users in this domain would actually say. Not a 5: common synonyms and variations are missing ("scrape", "captcha", "paywall", "can't access a page"). Not a 3: the present terms are natural user phrases, not jargon-only.

4 / 5

Distinctiveness Conflict Risk

Quotes: "curl_cffi TLS-impersonation grid + headless-browser fallback that gets past WAF/403/anti-bot", "open-web OSINT". A clear niche (sandboxed resilient page-fetching and OSINT search within a recon workflow) with distinct trigger terms; minimal risk of triggering for the wrong skill. The only mild overlap is generic 'web search', which the description scopes to allowlisted-provider OSINT.

5 / 5

Total

19

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

Total

15

/

16

Passed

Repository

PurpleAILAB/Decepticon

Path

packages/decepticon/decepticon/skills/standard/recon/open-web/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.