privilege-escalation

Host privilege escalation — Windows token impersonation, UAC bypass, service abuse, DLL hijacking, Linux SUID/sudo/kernel exploits, automated enumeration.

Quality

73%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/post-exploit/privilege-escalation/SKILL.md

Quality

Content

72%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A dense, highly actionable command reference with strong coverage of Windows and Linux privesc techniques, but it lacks structured validation checkpoints for its destructive operations and is a single large file with no progressive disclosure into bundle references.

Suggestions

Add explicit validation checkpoints for destructive operations, e.g. after a Potato/service-abuse run add a step to verify SYSTEM (`whoami /priv` or `whoami` shows SYSTEM) before proceeding to credential extraction, and re-validate after service restarts.

Split the per-tool detail tables and detection-signature reference into separate bundle files (e.g. references/potato-family.md, references/detection.md) and point to them from SKILL.md to apply progressive disclosure.

Move the large detection-rules block into a dedicated references file so the main SKILL.md reads as an overview plus quick-reference rather than a monolithic knowledge base.

Dimension	Reasoning	Score
Conciseness	Content is mostly terse command snippets with brief comments and assumes Claude's competence; minimal concept over-explanation, though a handful of inline explanatory notes and tables add minor length that could be trimmed.	4 / 5
Actionability	Fully executable, copy-paste-ready commands throughout — GodPotato, PrintSpoofer, sudo -l exploit patterns, SUID vectors, cron injection — covering the common cases with specific, runnable examples.	5 / 5
Workflow Clarity	There is an enumerate-before-exploit preamble and a Decision Gate for next steps, but the destructive/batch operations (kernel exploits, service restarts, persistence) lack explicit validate-then-proceed feedback loops, which per the rubric caps workflow clarity at 3.	3 / 5
Progressive Disclosure	No bundle files exist and the ~490-line SKILL.md is a single monolithic file with good section headers but no one-level-deep external references; substantial reference material (per-tool details, detection rules) that could live in separate files is inlined.	3 / 5
	Total	15 / 20 Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A highly specific, well-scoped description that names concrete escalation techniques across Windows and Linux, but it omits an explicit 'Use when...' trigger clause, which limits its completeness score. Trigger terms are strong but lean on tool jargon over natural user phrasing.

Suggestions

Add an explicit 'Use when...' clause, e.g. 'Use when escalating privileges on a compromised host — getting SYSTEM/root, privesc, or when the user mentions UAC bypass, SUID, sudo, or potato exploits.'

Broaden trigger terms to include natural user phrases like 'get root', 'become admin/SYSTEM', and 'escalate privileges' alongside the current tool-specific jargon.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete escalation vectors across both OSes — 'token impersonation, UAC bypass, service abuse, DLL hijacking, Linux SUID/sudo/kernel exploits, automated enumeration' — giving comprehensive coverage of specific actions rather than vague language.	5 / 5
Completeness	The description clearly states what the skill does but contains no explicit 'Use when...' trigger clause, which per the rubric guideline caps completeness at 3 even with a clear 'what'.	3 / 5
Trigger Term Quality	Includes natural terms like 'UAC bypass, SUID, sudo, kernel exploits' alongside tool-specific jargon (potato family, PrintSpoofer), with good but not complete coverage of the phrases a user would naturally say (e.g., 'get root', 'become admin').	4 / 5
Distinctiveness Conflict Risk	The niche is sharply defined — host privilege escalation with OS-specific vectors and named tool families — making it clearly distinguishable from sibling skills with minimal conflict risk.	5 / 5
	Total	17 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/post-exploit/privilege-escalation/SKILL.md
Commit: 31e1c8e

Reviewed: 20 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.