CtrlK
BlogDocsLog inGet started
Tessl Logo

offensive-krack-fragattacks

KRACK (CVE-2017-13077..082) and FragAttacks (CVE-2020-24586..588 + 26139-26147) — key reinstallation, fragmentation, and aggregation attacks against WPA2 supplicants. Covers Vanhoef's test scripts, viability against modern patched stacks (mostly mitigated post-2021), residual unpatched embedded devices and IoT vendors, and the practical limitations of these attacks in modern engagements. Use when assessing legacy supplicants, embedded clients, or vendors with poor patch cadence.

65

Quality

78%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./Skills/wireless/offensive-krack-fragattacks/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

68%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A concise, actionable reference with concrete commands and CVE tables, undermined mainly by a targeting workflow that omits validation/verification checkpoints for a destructive attack path. Structure and progressive disclosure are solid given no bundle files.

Suggestions

Add explicit validation checkpoints to the Targeting Workflow: verify the client has associated to the rogue AP (e.g., check hostapd logs / station entry) before running the test script, and confirm each CVE variant reproduces before logging it as vulnerable.

Trim the KRACK mechanism paragraph and the 'Probability of success today' framing to the essential patch-status facts, since Claude already understands 4-way handshake and keystream reuse.

Add a short note on prerequisites/legality (monitor-mode-capable adapter, authorized engagement scope) before the rogue-AP command block so the destructive steps are not run unguarded.

DimensionReasoningScore

Conciseness

Mostly efficient tables and command blocks with little padding; the one-paragraph KRACK mechanism explanation and some probability framing could be trimmed since Claude already knows WPA2 handshake basics, but the body largely respects token budget.

4 / 5

Actionability

Provides executable git clone URLs, test-script invocations (sudo ./krack-test-client.py), hostapd-mana and aireplay-ng commands with appropriately parameterized placeholders; minor gaps around required setup for the rogue AP and interface monitor mode.

4 / 5

Workflow Clarity

The Targeting Workflow lists a clear 4-step sequence but lacks validation checkpoints (e.g., confirm client association before testing, verify a CVE variant is reproducible before reporting) for a disruptive/deauth-driven operation, which caps this dimension.

3 / 5

Progressive Disclosure

Well-organized into clear single-level sections (When These Apply, KRACK, FragAttacks, Targeting Workflow, Detection, Reporting, Key References) with no nested references; at ~110 lines with all content inline it is well structured but exceeds the under-50-line simple-skill exception that would warrant a 5.

4 / 5

Total

15

/

20

Passed

Description

87%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A precise, third-person description that cleanly answers what and when with concrete CVE-scoped triggers and low conflict risk. Minor specificity gains possible by naming discrete operations instead of "attacks against".

DimensionReasoningScore

Specificity

Names the domain and several concrete attack classes — "key reinstallation, fragmentation, and aggregation attacks against WPA2 supplicants" plus "assessing legacy supplicants, embedded clients, or vendors with poor patch cadence" — but actions stay slightly abstract ("attacks against", "assessing") rather than enumerating discrete operations.

4 / 5

Completeness

Explicitly states both what (KRACK/FragAttacks key reinstallation, fragmentation, aggregation against WPA2 supplicants; covers test scripts, viability, residual devices, limitations) and when ("Use when assessing legacy supplicants, embedded clients, or vendors with poor patch cadence").

5 / 5

Trigger Term Quality

Strong natural terms for the audience ("KRACK", "FragAttacks", "WPA2 supplicants", "embedded clients", "IoT vendors", "poor patch cadence") with a usable "Use when..." trigger; a few common variants like "Wi-Fi"/"wireless" are absent.

4 / 5

Distinctiveness Conflict Risk

A narrow, well-defined niche pinned by CVE ranges and named attack families with distinctive triggers; overlap with any other skill is minimal.

5 / 5

Total

18

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
SnailSploit/Claude-Red
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.