CtrlK
BlogDocsLog inGet started
Tessl Logo

pentest-task-tree

Iterative PTT (Penetration Testing Tree) session reasoning — build, update, and traverse a live numbered task tree to drive LLM-guided pentest decisions across a full session.

61

Quality

72%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/decepticon/pentest-task-tree/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

77%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a highly actionable, well-sequenced playbook with concrete commands, a clear three-phase lifecycle, and explicit feedback loops. Its weaknesses are mild verbosity from duplicated examples and inline reference material that a progressive-disclosure split into bundle files would address.

Suggestions

Move the reference-heavy sections (MITRE ATT&CK mapping, detection notes, and the detailed tool-output distillation examples) into a references/ file and link to them from SKILL.md to reduce inline tokens.

Deduplicate the PTT tree examples — the initial format block and the state-file block show near-identical trees; keep one canonical example and reference it.

DimensionReasoningScore

Conciseness

The body is mostly efficient concrete guidance, but at ~230 lines it carries redundancy (two near-identical tree examples) and inline reference material (ATT&CK mapping, detection notes) that could be tightened, fitting the mostly-efficient-but-could-be-tighter anchor rather than the lean level 3.

2 / 3

Actionability

It provides real executable commands ('nmap -sV -sC -p-', 'gobuster', 'wget http://<target>/backup.zip -O backup.zip && unzip -l backup.zip'), a canonical next-task block format, a scoring formula, and concrete distillation rules — copy-paste ready.

3 / 3

Workflow Clarity

The session lifecycle is clearly sequenced (Phase 1 init → Phase 2 selection loop → Phase 3 ingestion/update) with an explicit feedback loop back to Phase 2, a decision tree, and result verification (mark completed/not-applicable), matching the clear-sequence-with-feedback anchor.

3 / 3

Progressive Disclosure

It is a single self-contained file with no bundle files or external references, and reference-style content (ATT&CK mapping, detection notes, detailed distillation examples) lives inline where it could be split out, fitting the some-structure-but-could-be-better-organized anchor.

2 / 3

Total

10

/

12

Passed

Description

67%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and distinct, naming concrete build/update/traverse actions for a pentest task tree. Its main weakness is the absence of an explicit 'Use when...' trigger clause and somewhat jargon-heavy trigger phrasing.

Suggestions

Add an explicit 'Use when...' clause listing natural triggers such as 'Use when running a live pentest session, deciding what to do next, or maintaining a pentest task tree'.

Soften jargon like 'Iterative PTT session reasoning' in favor of plain terms users would actually say (e.g., 'pentest task tree', 'next task', 'what to do next').

DimensionReasoningScore

Specificity

The description lists multiple concrete actions — 'build, update, and traverse a live numbered task tree to drive LLM-guided pentest decisions' — matching the multiple-specific-actions anchor rather than the domain-only level 2.

3 / 3

Completeness

It clearly answers 'what' the skill does but provides no explicit 'Use when...' trigger clause, which per the judging guidelines caps completeness at 2.

2 / 3

Trigger Term Quality

It includes relevant terms ('PTT', 'task tree', 'pentest') but leans on jargon ('Iterative PTT session reasoning') and omits natural variations a user would say such as 'what to do next' or 'next task', so it is not full coverage.

2 / 3

Distinctiveness Conflict Risk

The niche — live session-stateful pentest task-tree reasoning — is distinct and unlikely to trigger for unrelated skills, matching the clear-niche anchor.

3 / 3

Total

10

/

12

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

Total

15

/

16

Passed

Repository
PurpleAILAB/Decepticon
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.