CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

rmm-tool-abuse

Legitimate RMM tool abuse — deploy or hijack Atera, ScreenConnect, AnyDesk, TeamViewer for persistence, lateral movement, and C2. Leverages trusted software to evade EDR and blend with IT admin traffic.

Quality

72%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/exploit/rmm-tool-abuse/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

57%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A dense, command-rich body with a clear phase sequence and good decision guidance, weakened by a redundant Quick Reference, sparse validation checkpoints in batch-oriented workflows, and a monolithic single-file structure with no progressive disclosure into reference files.

Suggestions

Remove or trim the Quick Reference to truly novel quick-win commands, since its AnyDesk, ScreenConnect, Atera, and discovery snippets are repeated verbatim in the numbered sections.

Add explicit validation checkpoints after deployment steps (e.g., verify the agent service is running and the ID/password is retrievable before proceeding to the next phase).

Split per-tool deployment sections (AnyDesk, ScreenConnect, TeamViewer, Atera) into reference files under references/ and keep SKILL.md as an overview with clearly signaled links.

DimensionReasoningScore

Conciseness

The body is mostly lean command blocks, but the 'Quick Reference' section duplicates commands that reappear nearly verbatim in the Discovery and Deploying sections (AnyDesk silent install, ScreenConnect msiexec, Atera install, RMM enumeration), which is a clear tightening opportunity.

3 / 5

Actionability

Concrete, executable commands with parameterized placeholders dominate the body (curl, msiexec, reg query, vendor API calls), though sections 3–5 lean on comment-style UI guidance ('Navigate to Admin > Extensions') rather than executable code, leaving minor gaps.

4 / 5

Workflow Clarity

Sections 1–5 give a clear sequence (discovery → deploy → leverage existing → lateral movement → C2) plus a Decision Gate and Error Handling section, but explicit validation checkpoints are almost absent (a single 'sc query' verify), and batch-style lateral movement/mass deployment operations lack verify-then-proceed feedback loops, capping the score at 3.

3 / 5

Progressive Disclosure

The 275-line body is well-sectioned with headers and tables, but everything is inlined in a single file with no bundle references — per-tool deep dives and detection/error tables are natural candidates for separate reference files.

3 / 5

Total

13

/

20

Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A highly specific, distinctive description that names concrete tools and operations, weakened only by the absence of an explicit 'when to use' trigger clause and some natural-language synonyms that live only in the metadata's when_to_use field.

Suggestions

Append an explicit trigger clause to the description, e.g. 'Use when the task involves deploying, hijacking, or detecting remote monitoring and management (RMM) tools on endpoints.'

Include natural user phrasings such as 'remote access', 'remote desktop', or 'remote monitoring management' directly in the description rather than only in the metadata when_to_use field.

DimensionReasoningScore

Specificity

The description names the domain (RMM tool abuse), four specific tools (Atera, ScreenConnect, AnyDesk, TeamViewer), and multiple concrete operations — deploy, hijack, persistence, lateral movement, C2, EDR evasion — providing comprehensive coverage of the skill's capabilities.

5 / 5

Completeness

The 'what' is clear and concrete, but there is no 'Use when...' clause or equivalent explicit trigger guidance in the description field, which caps completeness at 3 per the rubric guideline.

3 / 5

Trigger Term Quality

Tool names (Atera, ScreenConnect, AnyDesk, TeamViewer) are natural terms users would say, but common phrasings like 'remote access', 'remote desktop', or the spelled-out 'remote monitoring management' are absent from the description itself — good coverage with a few natural terms missing.

4 / 5

Distinctiveness Conflict Risk

A clear niche (abuse of specific commercial RMM products) with named vendor tools makes this highly distinguishable from other skills with minimal conflict risk.

5 / 5

Total

17

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

Total

15

/

16

Passed

Repository

PurpleAILAB/Decepticon

Path

packages/decepticon/decepticon/skills/standard/exploit/rmm-tool-abuse/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.