CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

recon-reporting

Recon output formatting — report structure, CVSS v4.0 scoring (primary), MITRE ATT&CK mapping, finding prioritization, Markdown output, detection gap tracking, evidence coverage references.

Quality

70%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/recon/reporting/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

65%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable knowledge base: complete templates, concrete commands, and exact conventions that leave no ambiguity about what to produce. Its weaknesses are efficiency and architecture — it re-explains standard CVSS knowledge, duplicates content across sections, and inlines large reference tables that belong in separate files — plus the absence of an explicit, sequenced report-generation workflow with validation checkpoints.

Suggestions

Move the CVSS preset table, MITRE ATT&CK mapping table, and full finding template example into references/ files, keeping SKILL.md as a compact overview with clearly signaled one-level-deep links (also boosts progressive_disclosure).

Cut the standard CVSS 4.0 metric-group and severity-range explanations (Claude already knows these) and deduplicate the recon/ directory tree and Evidence/Detection Gap examples that repeat Sections 2 and 5-6.

Add a short sequenced workflow (create finding doc -> save evidence -> verify evidence paths referenced in the Evidence table exist -> score with CVSS -> prioritize -> consolidate) with explicit verification checkpoints before report assembly.

DimensionReasoningScore

Conciseness

The bulk is dense, domain-specific material Claude would not know (finding template, file conventions, CVSS presets), but it could be tightened: Section 4 re-explains standard CVSS 4.0 metric groups (AV/AC/AT/PR/UI/VC...) Claude already knows, the recon/ directory tree is duplicated in Sections 5 and 10, and the Evidence/Detection Gap examples in Sections 5-6 nearly duplicate the full template in Section 2. This matches anchor 3 ("mostly efficient but includes some unnecessary explanation or could be tightened") rather than 2 because the padding is a small minority of the ~455 lines and the rest is not padded.

3 / 5

Actionability

Fully executable guidance throughout: a complete copy-paste finding document template with exact frontmatter fields, runnable commands ("nmap -sV -p 3306 api.example.com", "mysql -h api.example.com -u root"), precise file-naming conventions ("findings/FIND-{NNN}.md", "FIND-{NNN}_{tool}.txt"), ready-made CVSS 4.0 vectors per common recon finding, and numeric prioritization thresholds ("CRITICAL | CVSS 4.0 >= 9.0"). This matches anchor 5: specific examples cover the common cases.

5 / 5

Workflow Clarity

The document is organized topically rather than as a sequenced process; the flow (run recon, save raw output, create finding docs, attach evidence, score, prioritize, consolidate the report) is only implicit in section order. There are no validation checkpoints (e.g., confirm referenced evidence files exist, verify vector/score consistency), matching anchor 3 ("sequence present but checkpoints missing or implicit"). It is not anchor 4 because no explicit ordered workflow is stated.

3 / 5

Progressive Disclosure

The body is well-sectioned with numbered headers and subsections, but it is a single ~19 KB file with no bundle files at all; large lookup assets (the CVSS preset table, the MITRE ATT&CK mapping table, and the full finding template example) are inlined when they are prime candidates for references/ files loaded only when needed. This matches anchor 3 ("some structure... content that should be separate is inline"). Not anchor 2 because the internal structure is clear and navigable, not minimal or buried.

3 / 5

Total

14

/

20

Passed

Description

66%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A specific, distinctive description that clearly communicates the skill's reporting scope and concrete deliverables. Its main weakness is the missing "when to use" trigger clause, which both caps completeness and weakens its activation quality. Adding an explicit trigger sentence would lift it to top-tier quality.

Suggestions

Append an explicit trigger clause, e.g., "Use when generating or consolidating a reconnaissance report, scoring findings with CVSS, prioritizing findings, mapping activity to MITRE ATT&CK, or handing off recon results."

Convert the noun-phrase list into action verbs ("Structure reports, score findings with CVSS v4.0, map activity to MITRE ATT&CK, prioritize findings") to sharpen the what-it-does statement.

Add natural synonyms users would say ("pentest report", "red team report", "engagement write-up", "executive summary") to improve trigger term coverage.

DimensionReasoningScore

Specificity

The description enumerates seven concrete deliverable components ("report structure", "CVSS v4.0 scoring (primary)", "MITRE ATT&CK mapping", "finding prioritization", "detection gap tracking", "evidence coverage references") with broad coverage, matching anchor 4. It falls short of anchor 5 because the items are noun phrases rather than stated actions, and the actual verbs (format, score, map, prioritize) are only implied by the leading "Recon output formatting".

4 / 5

Completeness

The "what" is clear and concrete, but the description contains no "Use when..." clause or any equivalent explicit trigger guidance (trigger phrases exist only in the separate metadata when_to_use field, not the description), which caps completeness at anchor 3 per the rubric guidelines.

3 / 5

Trigger Term Quality

Good natural keyword coverage: "recon", "report", "CVSS", "MITRE ATT&CK", "findings" are phrases a user would plausibly say when needing this skill. Not anchor 5 because common synonyms like "pentest report", "engagement report", "red team report", "write up findings", or "executive summary" are absent.

4 / 5

Distinctiveness Conflict Risk

"CVSS v4.0 scoring (primary)", "MITRE ATT&CK mapping", and "detection gap tracking" carve a distinct red-team recon-reporting niche unlikely to fire for unrelated skills. Not anchor 5: without explicit use-when triggers there is minor overlap risk with general report-writing or vulnerability-scanning skills.

4 / 5

Total

15

/

20

Passed

Validation

81%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 13 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

metadata_field

'metadata' should map string keys to string values

Warning

relative_links

Relative link issues: 2 missing

Warning

Total

13

/

16

Passed

Repository

PurpleAILAB/Decepticon

Path

packages/decepticon/decepticon/skills/standard/recon/reporting/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.