proxy-misconfig

Reverse proxy misconfigurations — nginx alias traversal, Apache mod_rewrite SSRF, Spring Boot Actuator exposure, Tomcat manager, IIS short-name disclosure.

Quality

79%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/exploit/web/proxy-misconfig/SKILL.md

Quality

Content

83%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is an exceptionally lean, actionable security cheat-sheet with copy-paste commands and good sectioning. Its main weakness is workflow clarity — multi-step destructive recipes (Tomcat WAR deploy, heapdump extraction) lack explicit validation checkpoints between steps.

Suggestions

Add verification steps to destructive/batch recipes, e.g. after `curl -T shell.war .../deploy` check the manager `list` endpoint returns the deployed app before triggering `/shell/`.

For the actuator PoC pattern, insert an explicit checkpoint (e.g. 'Confirm /actuator/env returns 200 before pulling heapdump') so the sequence has a feedback loop.

Flesh out the thin HTTP/2 section beyond a single pointer, or move it entirely to the cross-referenced smuggling.md to avoid a stub section.

Dimension	Reasoning	Score
Conciseness	Lean throughout with no padding or explanation of concepts Claude already knows — every code block and comment earns its place, e.g. '# trailing slash CRITICAL' and one-line bypass payloads.	5 / 5
Actionability	Copy-paste-ready curl/msfvenom/nginx commands cover the common cases (actuator env/heapdump, Tomcat WAR deploy, alias traversal, SSRF, IIS 8.3 probing) with only standard placeholders like $TARGET.	5 / 5
Workflow Clarity	Sequences exist (msfvenom -> deploy -> trigger shell; curl env -> heapdump -> strings grep) but no validation/verification checkpoints between steps; the destructive Tomcat RCE workflow lacks a deploy-success check before triggering, capping workflow clarity at 3.	3 / 5
Progressive Disclosure	Well-organized into numbered sections with one-level-deep, clearly signaled cross-references (ssrf.md, smuggling.md) under a dedicated Cross-references heading; minor gaps where some sections (e.g. HTTP/2) are thin pointers and the inline catalog is dense.	4 / 5
	Total	17 / 20 Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, keyword-rich, and clearly niched, but it omits any explicit 'when to use' trigger guidance, which caps completeness. Adding a 'Use when ...' clause referencing the trigger terms would round it out.

Suggestions

Append a 'Use when ...' clause (e.g. 'Use when auditing reverse proxies, nginx/apache/IIS/tomcat configs, or when SSRF/actuator/alias-traversal issues are suspected') to satisfy the 'when' half of completeness.

Add a few natural trigger synonyms users actually say ('default credentials', 'misconfig', 'config bug', 'exposed management interface') to lift trigger-term quality to comprehensive.

Keep the enumerated misconfig list — it is the description's strongest asset and drives both specificity and distinctiveness.

Dimension	Reasoning	Score
Specificity	Enumerates multiple concrete misconfiguration classes — 'nginx alias traversal', 'Apache mod_rewrite SSRF', 'Spring Boot Actuator exposure', 'Tomcat manager', 'IIS short-name disclosure' — giving comprehensive coverage of the niche rather than vague abstractions.	5 / 5
Completeness	It clearly states the 'what' (reverse proxy misconfigurations with enumerated types) but provides no 'Use when...' clause or equivalent explicit trigger guidance, so completeness is capped at 3 per the rubric.	3 / 5
Trigger Term Quality	Strong keyword coverage of product names and attack types users would naturally say (nginx, apache, SSRF, actuator, tomcat, IIS), but a few natural synonyms (e.g. 'misconfig', 'default creds', 'config bug') are absent so it is not fully comprehensive.	4 / 5
Distinctiveness Conflict Risk	A clear niche — reverse proxy / infrastructure misconfigurations tied to specific products and attack classes — with distinct triggers and minimal overlap risk against other skills.	5 / 5
	Total	17 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/exploit/web/proxy-misconfig/SKILL.md
Commit: 0cf691e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.