web

Web application exploitation — the primary category skill for all web-based attacks. This is a routing skill: read this first to identify the attack type, then load the appropriate specialized sub-skill for detailed procedures. Covers 11 technique areas across injection, file access, authentication, and API exploitation.

Quality

71%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/exploit/web/SKILL.md

Quality

Content

85%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is a well-structured, highly actionable routing overview with executable detection probes, a clear decision flow, and a disciplined payload-pacing feedback loop, with only minor conciseness loss from the three overlapping routing presentations.

Dimension	Reasoning	Score
Conciseness	The body avoids explaining concepts Claude already knows, but it presents overlapping routing logic three ways (the 30-row table, the quick-detection probes, and the decision-flow tree), so it could be tightened despite being accurate.	2 / 3
Actionability	It supplies copy-paste-ready, executable curl detection probes, concrete load_skill(...) paths in a dedicated Path column, and explicit tool calls (cve_lookup, cve_poc_lookup) for the CVE workflow.	3 / 3
Workflow Clarity	A clear sequence is given (identify via probes/decision tree -> load sub-skill -> execute) with explicit checkpoints and a feedback loop: three same-class negatives trigger a pivot, and three exhausted classes trigger writing exploit/PIVOT.md and switching targets.	3 / 3
Progressive Disclosure	It is a clean overview that routes to one-level-deep specialized sub-skills via a clearly signaled Path column, with content appropriately split across the sub-skills; no local bundle files are present to contradict this.	3 / 3
	Total	11 / 12 Passed

Description

57%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description clearly communicates the skill's role as a routing layer for web exploitation and is distinctive, but it lacks an explicit 'Use when...' trigger clause, keeps most natural trigger terms in metadata rather than the description, and makes an inaccurate '11 technique areas' claim.

Suggestions

Add an explicit 'Use when...' clause to the description (e.g., 'Use when the target is a web application or HTTP service and you need to identify the attack class before loading a specialized sub-skill') to satisfy the completeness trigger requirement.

Surface the natural trigger terms a user would actually say (SQL injection, XSS, SSRF, file upload, deserialization) directly in the description instead of relying solely on metadata.when_to_use.

Correct or remove the 'Covers 11 technique areas' claim, since the routing table lists ~30 sub-skills; an inaccurate count reads as an over-claim.

Dimension	Reasoning	Score
Specificity	It names concrete routing actions ('identify the attack type', 'load the appropriate specialized sub-skill') but stops at two core actions, and the claim 'Covers 11 technique areas' is inaccurate given the body enumerates ~30 sub-skills.	2 / 3
Completeness	The 'what' is clearly stated (routing skill that identifies the attack type and loads a sub-skill), but there is no 'Use when...' clause or equivalent explicit trigger guidance, which caps completeness at 2.	2 / 3
Trigger Term Quality	Some relevant terms appear ('Web application exploitation', 'injection', 'API exploitation') but the natural keywords users actually say (SQLi, XSS, SSRF, file upload) are relegated to metadata.when_to_use rather than the description itself.	2 / 3
Distinctiveness Conflict Risk	The phrase 'the primary category skill for all web-based attacks' carves out a clear, distinct niche as the web-exploitation router that is unlikely to trigger for the wrong skill.	3 / 3
	Total	9 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/exploit/web/SKILL.md
Commit: e34afba

Reviewed: 10 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.