post-exploit-reporting

Post-exploitation finding documentation — credential access, privilege escalation, lateral movement reports, detection gap analysis, attack path documentation, CVSS v4.0 scoring.

Quality

73%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/post-exploit/reporting/SKILL.md

Quality

Content

71%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-sequenced knowledge base of post-exploitation reporting templates, dragged down by verbosity from inlined reference tables and a lack of progressive disclosure splitting content into bundle files.

Suggestions

Move the MITRE ATT&CK mapping table (Section 5) and the CVSS v4.0 score table (Section 4) into separate reference files (e.g., references/mitre-mapping.md, references/cvss-scores.md) and link to them from SKILL.md to improve both conciseness and progressive disclosure.

Consider extracting the four worked example findings into a references/examples/ directory, keeping only one concise canonical template inline plus a pointer to the rest.

Add an explicit validation feedback loop in the Evidence Collection Checklist (e.g., 'If a finding is missing Detection Gap Analysis, return and complete it before marking the objective done') to raise workflow clarity.

Dimension	Reasoning	Score
Conciseness	Mostly efficient templates, but the body inlines large reference tables Claude already knows (full MITRE ATT&CK mapping, CVSS v4.0 score table) plus fully worked example findings with mock hashes, adding notable padding that could be trimmed.	3 / 5
Actionability	Fully executable guidance across all phases: concrete YAML frontmatter schemas, copy-paste commands (nanodump, impacket-psexec), CVSS vectors, evidence paths, a file-organization tree, and an evidence checklist covering the common post-exploit cases.	5 / 5
Workflow Clarity	Clear sequencing with phase-specific templates and an Evidence Collection Checklist serving as validation checkpoints, but no explicit validate-fix-retry feedback loop for the destructive credential/exfiltration operations.	4 / 5
Progressive Disclosure	Good section structure but all content is inlined in a single ~537-line SKILL.md with no bundle files; bulk reference material (MITRE table, CVSS table, full worked examples) that belongs in separate referenced files is kept inline.	3 / 5
	Total	15 / 20 Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A specific, well-targeted description with strong action coverage and clear niche identity, weakened only by the absence of an explicit 'when to use' trigger clause in the description field itself.

Suggestions

Append an explicit 'Use when...' clause to the description (e.g., 'Use when documenting post-exploitation findings, credential access, privilege escalation, lateral movement, or detection gaps') to lift completeness.

Add common synonyms and natural variations users might say (e.g., 'findings', 'cred dump', 'Pass-the-Hash', 'PtH', 'red team report') to broaden trigger-term coverage.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'credential access, privilege escalation, lateral movement reports, detection gap analysis, attack path documentation, CVSS v4.0 scoring' — giving comprehensive coverage of the domain rather than a few examples.	5 / 5
Completeness	The 'what' is clearly stated but there is no 'Use when...' clause in the description field; trigger guidance lives only in metadata.when_to_use, which per the rubric caps completeness at 3.	3 / 5
Trigger Term Quality	Good natural keywords a red-teamer would say (credential access, privilege escalation, lateral movement, detection gap, attack path), but missing common synonyms and file extensions that would make coverage comprehensive.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (post-exploitation reporting) with distinct, domain-specific triggers and minimal overlap risk with unrelated skills.	5 / 5
	Total	17 / 20 Passed

Validation

81%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 13 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (550 lines); consider splitting into references/ and linking	Warning
metadata_version	'metadata.version' is missing	Warning
metadata_field	'metadata' should map string keys to string values	Warning

	Total	13 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/post-exploit/reporting/SKILL.md
Commit: 31e1c8e

Reviewed: 8 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.