xs-leaks

XS-Leaks — cross-site information leaks via timing, frame counting, navigation, error oracles. Side-channel attacks against same-origin authenticated state.

Quality

53%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/exploit/web/xs-leaks/SKILL.md

Quality

Content

50%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a tight, well-organized catalog of XS-leak techniques with several executable snippets and a useful severity/defender reference, but it has no explicit multi-step workflow with validation and leaves some technique categories as prose.

Suggestions

Tighten the opening paragraph to remove conceptual framing Claude already knows and lead directly with the technique catalog.

Add complete executable snippets for the prose-only categories (error-event oracle, CSS style oracle, cache-timing search presence) instead of descriptions.

Turn the PoC framing section into a numbered workflow with validation checkpoints (verify attacker-host isolation, confirm victim authenticated state, confirm observable differential before recording).

Dimension	Reasoning	Score
Conciseness	Mostly lean with concrete snippets, but the opening conceptual paragraph ('XS-Leaks abuse browser primitives that leak information ACROSS origins...') and asides like 'browser mitigations evolve fast' explain context Claude largely already knows.	2 / 3
Actionability	Provides real executable JS (performance.now timing, frame-count iframe, no-cors fetch timing), but several categories (error-event oracle, CSS injection, search-presence) are prose-only and the ID-guess loop is left as a commented placeholder.	2 / 3
Workflow Clarity	Section 4 lists PoC requirements and a loose document/record sequence, but the multi-step attacker-host setup lacks explicit validation checkpoints or feedback loops, capping this at 2.	2 / 3
Progressive Disclosure	Well-organized into clear sections with a clearly signaled external reference (xsleaks.dev) and a cross-references block, but with no bundle files all content sits inline and nothing is progressively split into reference files.	2 / 3
	Total	8 / 12 Passed

Description

57%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and distinctive, naming a clear niche and concrete leak techniques, but it reads as a topic definition rather than a trigger-oriented skill description and omits any explicit 'Use when' guidance.

Suggestions

Add an explicit 'Use when...' clause naming natural triggers (e.g., 'Use when investigating cross-site information leaks, XS-Search, frame-counting, or timing oracles against an authenticated target').

Reframe technique names as actions the skill performs (e.g., 'Detect, exploit, and document XS-leaks via timing, frame-counting, navigation, and error oracles') to lift specificity.

Include common user phrasings like 'xsleak', 'XS-Search', and 'side-channel' alongside the existing terms to broaden trigger coverage.

Dimension	Reasoning	Score
Specificity	Names the domain and several concrete techniques ('timing, frame counting, navigation, error oracles'), but describes the attack class rather than concrete actions the skill performs, matching anchor 2 over the action-list anchor 3.	2 / 3
Completeness	Clearly answers what the skill covers but lacks any 'Use when...' clause or explicit trigger guidance (the when_to_use lives in metadata, not the description), which caps completeness at 2 per the guidelines.	2 / 3
Trigger Term Quality	Good primary natural terms ('XS-Leaks', 'cross-site information leaks', 'Side-channel attacks') but jargon-heavy ('error oracles', 'same-origin authenticated state') and missing common variations like 'xsleak' or 'XS-Search'.	2 / 3
Distinctiveness Conflict Risk	Occupies a clear, specific niche (browser cross-site side-channel leaks) with distinct triggers that are unlikely to conflict with other skills, matching anchor 3.	3 / 3
	Total	9 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/exploit/web/xs-leaks/SKILL.md
Commit: e34afba

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.