ssrf

Hunt Server-Side Request Forgery (CWE-918) through taint analysis from user-controlled URLs to HTTP client sinks. Covers cloud metadata pivoting, DNS rebinding, gopher smuggling, and the IMDSv1 → IAM role chain that turns SSRF into RCE.

Quality

80%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/analyst/ssrf/SKILL.md

Quality

Content

82%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A tight, highly actionable SSRF hunting playbook with executable commands, a validation-backed workflow, and clean sectioning; only minor conciseness trimming and a lack of file-splitting keep it just below top marks.

Dimension	Reasoning	Score
Conciseness	A lean playbook of tables, grep/semgrep commands, and PoC templates with almost no padding; the opening 'why scanners miss' framing and section-3 heading editorialize slightly and could be trimmed. Not a 5 because of those minor over-explanation instances.	4 / 5
Actionability	Fully executable, copy-paste-ready guidance: concrete semgrep/grep commands, a curl PoC template, specific taint checks (urlparse .hostname vs raw URL, IP-allowlist TOCTOU, allow_redirects=False), and CVSS vectors covering the common cases.	5 / 5
Workflow Clarity	Section 4 gives a clear numbered taint-audit sequence and section 5 provides validation via validate_finding success/negative patterns plus a negative control. Not a 5 because an explicit failure→fix→retry feedback loop is not spelled out.	4 / 5
Progressive Disclosure	Seven well-organized, clearly headed sections make a self-contained ~100-line playbook easy to navigate. Not a 5 because it is a single monolithic inline file with no one-level-deep references to detailed materials (none are needed, but the 5-anchor pattern of signaled references is not demonstrated).	4 / 5
	Total	17 / 20 Passed

Description

77%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A highly specific, distinctive description with strong natural trigger terms, weakened only by the absence of an explicit 'Use when…' clause that caps completeness at 3.

Suggestions

Add an explicit 'Use when…' trigger clause, e.g. 'Use when hunting SSRF, following user-controlled URLs to HTTP client sinks, or triaging cloud-metadata / internal-service pivots.' to lift completeness above 3.

Surface the 'SSRF' abbreviation earlier (e.g. lead with 'Hunt Server-Side Request Forgery (SSRF, CWE-918)…') so the most common trigger term appears up front for discovery.

Reframe the covered sub-techniques as discrete actions the skill performs (e.g. 'identifies bypass classes, validates with PoC templates, scores CVSS') to push specificity toward 5.

Dimension	Reasoning	Score
Specificity	Names the domain and a concrete method ('taint analysis from user-controlled URLs to HTTP client sinks') plus several specific coverage areas (metadata pivoting, DNS rebinding, gopher smuggling, IMDSv1→IAM chain). Not a 5 because it frames one hunting action with covered sub-techniques rather than listing multiple distinct actions.	4 / 5
Completeness	Has a clear 'what' (hunt SSRF via taint analysis to HTTP client sinks) but no explicit 'Use when…' trigger clause; per the judging guidelines, a missing explicit trigger clause caps completeness at 3.	3 / 5
Trigger Term Quality	Includes natural terms and synonyms a user would actually say — 'Server-Side Request Forgery (CWE-918)', 'SSRF', 'taint analysis', 'cloud metadata', 'DNS rebinding', 'gopher smuggling', 'IAM role' — with comprehensive coverage.	5 / 5
Distinctiveness Conflict Risk	A sharply defined CWE-918/SSRF/taint-analysis niche with distinct triggers and minimal overlap risk with other skills.	5 / 5
	Total	17 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/analyst/ssrf/SKILL.md
Commit: 0cf691e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.