CtrlK
BlogDocsLog inGet started
Tessl Logo

web-recon

Web application enumeration hub — directory/file fuzzing, vhost discovery, API enumeration, CMS scanning, WAF detection, auth surface mapping, cookie audit.

63

Quality

75%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/recon/web-recon/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

86%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is a well-structured, token-efficient routing hub with executable dedup logic and explicit resume/stop checkpoints for batch operations. Its only gap is that the actual enumeration procedures live in sub-skills, so the hub itself is more navigational than procedural.

DimensionReasoningScore

Conciseness

The body is lean: two routing tables, a copy-paste dedup snippet, and an output-file tree, with no padding or explanation of concepts Claude already knows; every section earns its tokens.

5 / 5

Actionability

The dedup bash block and tag-driven first actions (e.g. "Probe every reflection point with {{7*7}}") are concrete and executable, but the core enumeration methodology is delegated to sub-skills via load_skill rather than stated inline.

4 / 5

Workflow Clarity

The Resume rule and Stop rule (5 consecutive same status/size → pivot) provide explicit validation checkpoints and a feedback loop for batch probing, but there is no overarching numbered workflow sequence tying the sub-skills together.

4 / 5

Progressive Disclosure

The hub is a clear overview with well-signaled one-level-deep references via load_skill tables and tag fast paths; content is appropriately split across sub-skills with easy navigation and no nested references.

5 / 5

Total

18

/

20

Passed

Description

63%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and well-scoped to web recon with a strong action list, but it omits an explicit "Use when..." trigger clause and relies on jargon over natural user phrases. Adding trigger guidance and natural synonyms would raise the completeness and trigger-term dimensions.

Suggestions

Append an explicit 'Use when...' clause to the description, e.g. 'Use when scanning or enumerating a web application, fingerprinting a web app, or mapping its attack surface.'

Add natural-language synonyms users actually say (e.g. 'website scanning', 'web app recon', 'fingerprinting') alongside the technical terms to improve trigger-term coverage.

Differentiate from sibling recon skills by noting the web-application focus explicitly (e.g. 'web-tier enumeration, not host or network recon') to reduce overlap risk.

DimensionReasoningScore

Specificity

The description enumerates seven concrete actions ("directory/file fuzzing, vhost discovery, API enumeration, CMS scanning, WAF detection, auth surface mapping, cookie audit"), giving comprehensive coverage of the hub's capabilities rather than vague language.

5 / 5

Completeness

The description gives a clear "what" (enumeration hub plus action list) but lacks any "Use when..." trigger clause in the description field itself, which per the rubric caps completeness at 3.

3 / 5

Trigger Term Quality

It includes relevant terms like "web application enumeration" but leans heavily on technical jargon (vhost, WAF, CMS) and omits natural synonyms a user would say ("website scanning", "web app recon", "fingerprinting").

3 / 5

Distinctiveness Conflict Risk

"Web application enumeration hub" with a detailed action list carves a clear niche with minimal conflict risk, though it could broadly overlap with sibling reconnaissance skills (host/network recon).

4 / 5

Total

15

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

Total

15

/

16

Passed

Repository
PurpleAILAB/Decepticon
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.