profinet

PROFINET (L2 EtherType 0x8892 / DCP) attack playbook — DCP Identify-All broadcast enumeration, device fingerprinting, station-name and IP reassignment (breaks IO-controller mapping), flash-LED physical location, factory-reset, RT frame injection/replay for cyclic-IO spoofing. Siemens/EU fieldbus peer of S7Comm; requires same L2 broadcast domain.

Quality

72%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/exploit/ics-ot/profinet/SKILL.md

Quality

Content

77%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, highly actionable multi-phase attack playbook with strong safety gating and verification guidance, weakened only by a monolithic inline layout that does not offload detail into reference files and some redundant prose.

Suggestions

Offload the long scapy frame-builder scripts (Phases 1–5) into scripts/ files and keep SKILL.md as an overview that signals them one level deep, improving progressive disclosure.

De-duplicate the BF (Bus Fault) explanation and trim the introductory fieldbus paragraph to assume Claude's competence, tightening conciseness.

Dimension	Reasoning	Score
Conciseness	Mostly efficient — executable code dominates and inline comments carry real protocol detail — but the prose intro re-explains fieldbus/L2 context and the BF (Bus Fault) state is explained twice, so it could be tightened; not a 3 because not every token earns its place.	2 / 3
Actionability	Fully executable scapy frame builders with concrete protocol constants (FrameID 0xFEFE/0xFEFD, ServiceIDs, option/suboption bytes), plus copy-paste tcpdump/wireshark filter commands; the commented-out Set invocations are justified safety gates, not pseudocode.	3 / 3
Workflow Clarity	Phases 1–5 are clearly sequenced with an explicit SAFETY FIRST gate and a 'STOP ... write-class authorization required' gate before Phase 4 destructive ops, and verification steps exist (record original station names/IPs, confirm Set accepted via BlockError=0x00, follow-up DCP Get) — so the destructive-op validation cap does not apply.	3 / 3
Progressive Disclosure	Well-organized into labeled phases/sections (not a disorganized wall), but at ~340 lines the entire playbook is inline with no content offloaded to bundle/reference files despite the size, fitting the anchor where content that should be separate is inline; no bundle files exist to provide one-level-deep navigation.	2 / 3
	Total	10 / 12 Passed

Description

67%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A highly specific, technically precise description that clearly names its niche and capabilities, but it omits an explicit 'Use when...' trigger clause (delegating triggers to metadata.when_to_use) and leans on jargon over natural user phrasing.

Suggestions

Add an explicit 'Use when ...' clause to the description (e.g., 'Use when assessing PROFINET/DCP fieldbus segments ...') so the description itself answers 'when' without relying on metadata.when_to_use.

Soften the dense jargon run-on with a few natural trigger phrasings a user might actually say (e.g., 'PROFINET device discovery', 'reset a PROFINET device', 'spoof PROFINET IO data').

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'DCP Identify-All broadcast enumeration, device fingerprinting, station-name and IP reassignment (breaks IO-controller mapping), flash-LED physical location, factory-reset, RT frame injection/replay for cyclic-IO spoofing' — matching the anchor for listing several specific concrete actions.	3 / 3
Completeness	The 'what' is thorough, but there is no 'Use when...' clause or equivalent explicit trigger guidance in the description field — the only 'when'-adjacent text ('requires same L2 broadcast domain') is a prerequisite, not a trigger — so per the rubric guideline completeness is capped at 2.	2 / 3
Trigger Term Quality	Relevant domain terms appear (PROFINET, DCP, 0x8892, factory-reset, flash-LED, station-name) but the phrasing is jargon-heavy; natural trigger phrasing a user would say is in metadata.when_to_use rather than in the description itself, so common variations are partly missing.	2 / 3
Distinctiveness Conflict Risk	A clear niche (PROFINET/DCP L2 attack playbook) with distinct triggers (0x8892, DCP, RT frame injection) that would not plausibly fire for another skill; the S7Comm peer reference clarifies rather than blurs the boundary.	3 / 3
	Total	10 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/exploit/ics-ot/profinet/SKILL.md
Commit: e34afba

Reviewed: 11 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.