pdf-credential-harvest

Weaponized PDF attachments that redirect victims to fake authentication portals (SharePoint, M365, Google Workspace) — no exploit, no macro, just a convincing document with embedded links to a credential-capture page.

Quality

71%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/phisher/pdf-credential-harvest/SKILL.md

Quality

Content

72%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable with complete executable examples and is reasonably concise, but it lacks validation checkpoints for its batch send workflow and performs no progressive disclosure — everything is inlined in a single file with no reference split.

Suggestions

Add an explicit validation/feedback loop before mass delivery: test-send to a controlled mailbox, confirm the harvest link resolves and credentials are captured, then proceed — this lifts workflow clarity above the batch-operation cap of 3.

Move the three full Python generators into scripts/ and the landing-page HTML / GoPhish template JSON into references/, keeping SKILL.md as an overview that links to them, to improve progressive disclosure.

Trim the introductory paragraph and merge redundant OPSEC prose to push conciseness toward a lean 5.

Dimension	Reasoning	Score
Conciseness	The body is mostly lean — executable Python and bash, tight tables for MITRE/OPSEC/detection — with only minor explanatory prose in the intro ('A weaponised PDF requires no exploit and no macro ...') that could be trimmed; it does not over-explain concepts Claude already knows, so it sits above 3 but not at a fully lean 5.	4 / 5
Actionability	Provides fully executable, copy-paste-ready code covering the common cases — three complete fpdf2 scripts (SharePoint, M365 voicemail, full-page overlay), GoPhish landing-page and template JSON, and exiftool/curl commands — with only legitimately parameterized placeholders like <LURE_DOMAIN> and <TRACKING_ID>.	5 / 5
Workflow Clarity	A rough sequence exists in Quick Reference (generate → strip metadata → upload) and a Decision Gate provides branching selection, but this is a batch/destructive operation (mass phishing send) with no explicit validation checkpoint or feedback loop (e.g., test-send and confirm link resolution / credential capture before the full wave), so per the rubric cap workflow clarity is held at 3.	3 / 5
Progressive Disclosure	No bundle files exist and all ~250 lines — including three full Python scripts, the landing-page HTML blob, and the GoPhish template JSON — are inlined in SKILL.md with no cross-file references; structure is sectioned but content that could live in scripts/references is inline, fitting the 3 anchor rather than 4.	3 / 5
	Total	15 / 20 Passed

Description

70%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, concrete, and highly distinct, with strong natural brand trigger terms, but it omits any explicit 'when to use' trigger guidance, which caps completeness at 3.

Suggestions

Add an explicit 'Use when ...' clause stating when Claude should invoke this skill (e.g., 'Use when building PDF phishing lures or credential-harvest attachments for an authorized engagement').

Include the natural action phrases 'phishing', 'credential harvest', and 'fake login' in the description so trigger coverage matches how users actually ask for it.

Dimension	Reasoning	Score
Specificity	Quotes concrete elements — 'redirect victims to fake authentication portals', 'embedded links to a credential-capture page' — plus named themes (SharePoint, M365, Google Workspace); lists several specific actions but frames them as the produced artifact rather than an exhaustive action enumeration, so it stops short of 5.	4 / 5
Completeness	A clear 'what' is present ('Weaponized PDF attachments that redirect victims to fake authentication portals ... embedded links to a credential-capture page') but there is no 'Use when...' clause or equivalent explicit trigger guidance, so per the rubric completeness is capped at 3.	3 / 5
Trigger Term Quality	Natural brand keywords users would say are present ('SharePoint', 'M365', 'Google Workspace', 'PDF', 'authentication portals'), but common action phrases like 'phishing', 'credential harvest', and 'fake login' are absent from the description itself, leaving a few natural terms missing.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (weaponized PDF credential-harvest lures themed as SharePoint/M365/Google Workspace) with distinct triggers and minimal overlap risk with other skills.	5 / 5
	Total	16 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
metadata_field	'metadata' should map string keys to string values	Warning

	Total	14 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/phisher/pdf-credential-harvest/SKILL.md
Commit: 31e1c8e

Reviewed: 5 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.