CtrlK
BlogDocsLog inGet started
Tessl Logo

references

External knowledge integration — HackerOne reports, PayloadsAllTheThings, Book of Secret Knowledge, CVE PoC corpora, bug bounty methodologies, and reference pentest agent architectures. Use these to calibrate, look up payloads, and accelerate research.

63

Quality

75%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/shared/references/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

75%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured reference-catalogue skill: lean, action-oriented with concrete tool calls, a clear sequenced workflow plus a validation loop, and good single-file organization. Minor gains are available in tightening prose and documenting call return shapes.

Suggestions

Add a one-line note on what ref_suggest/payload_search return (e.g., a list of slugs or payload strings) so Claude knows how to consume the result.

Tighten the closing reference-architecture section into a short bullet list to reduce trailing prose.

DimensionReasoningScore

Conciseness

The body is efficient and avoids explaining concepts Claude already knows; the catalogue table and per-scenario blocks are tight, with only minor phrasing that could be trimmed.

4 / 5

Actionability

Provides concrete, near-copy-paste tool calls with realistic arguments (ref_suggest(vuln_class="...", goal="recon"), payload_search(vuln_class="ssrf", keyword="imds"), ref_fetch("payloads-all-the-things"), ref_grep(...)), with only minor gaps around return shapes.

4 / 5

Workflow Clarity

A clear 5-step Workflow is present alongside per-scenario sub-workflows, and step 5 adds a validation loop (record borrowed payloads as hypothesis nodes until validated); checkpoints are mostly explicit.

4 / 5

Progressive Disclosure

Single self-contained file with clear section headers and one-level-deep runtime references (fetch/grep into repos) rather than nested bundle files; well organized with only minor structural gaps.

4 / 5

Total

16

/

20

Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A specific, well-scoped description that names concrete resources and gives clear usage triggers in third-person voice. Both the "what" and "when" are answered, with only minor room for sharper trigger phrasing.

Suggestions

Tighten the trigger clause into an explicit "Use when ..." sentence listing natural user phrases (e.g., "Use when looking up payloads, calibrating CVSS/reward against disclosed reports, or finding a CVE PoC").

Add a couple of common synonyms/file tokens (e.g., "exploit", "PoC", "H1") to broaden natural keyword coverage.

DimensionReasoningScore

Specificity

Names a concrete domain and several specific resources and actions ("HackerOne reports, PayloadsAllTheThings, Book of Secret Knowledge, CVE PoC corpora", "calibrate, look up payloads, and accelerate research"), with only minor gaps in coverage.

4 / 5

Completeness

Clearly answers "what" (external knowledge integration across named corpora and reference architectures) and "when" ("Use these to calibrate, look up payloads, and accelerate research"), though the trigger phrasing could be slightly more explicit.

4 / 5

Trigger Term Quality

Includes several natural keywords users would say ("hackerone", "payloadsallthethings", "cve poc", "bug bounty methodology", "pentest agent"), though the description leans on resource names rather than fuller synonym coverage.

4 / 5

Distinctiveness Conflict Risk

The pentest reference-catalogue niche is distinct with little overlap risk against unrelated skills, written in third person; only minor overlap with adjacent recon/payload skills.

4 / 5

Total

16

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

Total

15

/

16

Passed

Repository
PurpleAILAB/Decepticon
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.