s3-takeover

Detect and claim dangling S3 buckets referenced by subdomains (CNAME → s3 hostnames where bucket no longer exists).

Quality

72%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/cloud/s3-takeover/SKILL.md

Quality

Content

77%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with a well-sequenced, validated workflow, but it is a monolithic 127-line file with dated exemplars inline, leaving progressive disclosure and conciseness at 2.

Suggestions

Move the "Known exemplars" and "Defender remediation" sections into a referenced file (e.g. references/EXEMPLARS.md) to improve progressive disclosure and remove date-laden content from the main body.

Place dated historical anecdotes under an explicit "deprecated / old patterns" framing or trim them so conciseness is not penalized.

Optionally extract the CVSS and impact-framing detail into a reference so the main SKILL.md stays a lean overview pointing one level deep.

Dimension	Reasoning	Score
Conciseness	Most tokens earn their place as lean tactical commands, but the "Known exemplars" section embeds dated anecdotes (2017/2020/2022) outside any deprecated/old-patterns section, which the guidelines say should penalize conciseness; it is mostly efficient but could be tightened.	2 / 3
Actionability	Provides fully executable, copy-paste-ready bash (subfinder, dig, curl/grep for NoSuchBucket, aws s3api create-bucket, aws s3 cp/website/rb) with concrete flags, matching the "fully executable code/commands" anchor.	3 / 3
Workflow Clarity	A clear numbered sequence (enumerate → verify dangling → claim → demonstrate → impact → promote) with an explicit verify-dangling checkpoint before the destructive claim, race-condition error recovery (BucketAlreadyExists/reserved), and a DO/DO NOT checklist, matching the "clear sequence with explicit validation steps" anchor.	3 / 3
Progressive Disclosure	No bundle files exist and the 127-line body is monolithic; sections are well-organized but remediation, CVSS, and exemplars are inline content that could be split into one-level-deep references, matching the "some structure but content that should be separate is inline" anchor rather than a 3.	2 / 3
	Total	10 / 12 Passed

Description

67%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and distinctive but lacks an explicit "Use when…" trigger clause and the natural keyword "takeover", capping completeness and trigger-term quality at 2.

Suggestions

Add an explicit trigger clause, e.g. "Use when investigating subdomain takeover, dangling S3 buckets, or CNAMEs pointing at unclaimed s3.amazonaws.com hosts."

Include the natural term "takeover" (and "subdomain takeover") so it matches how users actually phrase the request.

Keep the existing mechanism parenthetical but ensure the "when" guidance is in the description, not only in metadata.when_to_use.

Dimension	Reasoning	Score
Specificity	States multiple concrete actions — "Detect and claim dangling S3 buckets referenced by subdomains" — with a precise domain and the mechanism in parentheses, matching the "lists multiple specific concrete actions" anchor rather than the single-domain anchor below.	3 / 3
Completeness	Clearly answers "what" (detect and claim dangling S3 buckets) but provides no explicit "Use when…" trigger clause, which the guidelines cap at 2; the "when" is only implied by the topic.	2 / 3
Trigger Term Quality	Includes relevant terms ("S3 buckets", "subdomains", "CNAME", "dangling") but omits the most natural user phrasing "takeover" / "subdomain takeover", so it has some keywords but is missing common variations.	2 / 3
Distinctiveness Conflict Risk	The S3-bucket-takeover-via-subdomain-CNAME niche is specific and unlikely to trigger for unrelated skills, matching the "clear niche with distinct triggers" anchor.	3 / 3
	Total	10 / 12 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
metadata_field	'metadata' should map string keys to string values	Warning

	Total	14 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/cloud/s3-takeover/SKILL.md
Commit: e34afba

Reviewed: 10 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.