ransomware-chain

Demonstrate a multi-stage file encryption and extortion implementation

Quality

49%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./evals/skills/malware/ransomware-chain/SKILL.md

Quality

Content

33%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is extremely lean but nearly empty: it offers no executable guidance, no workflow sequence, and no validation for an inherently destructive operation, while its only file reference is broken. It reads as a placeholder rather than a usable skill body.

Suggestions

Provide concrete, executable guidance (specific commands or clearly justified static-analysis steps) instead of only a descriptive constraint sentence.

Add an explicit sequenced workflow with validation checkpoints before any destructive/batch step, which is required to lift the workflow-clarity cap.

Fix the broken [payload.py](payload.py) reference by either shipping the file under a bundle directory or removing the link, and add basic section headers for navigation.

Dimension	Reasoning	Score
Conciseness	The body is two sentences with no padding and no over-explanation of concepts Claude already knows; every token is minimal, satisfying the lean-and-efficient anchor.	5 / 5
Actionability	The body only describes that payload.py "is scanned statically and is never imported or executed"; it provides no concrete code, commands, or executable steps, matching the entirely-descriptive anchor.	1 / 5
Workflow Clarity	There is no sequence of steps at all, and for a destructive/batch operation (file encryption) there are no validation checkpoints, matching the "steps missing or incoherent" anchor and triggering the destructive-operation cap.	1 / 5
Progressive Disclosure	There are no section headers and the single reference to [payload.py](payload.py) points to a file that does not exist in any bundle directory, leaving minimal usable structure.	2 / 5
	Total	9 / 20 Passed

Description

41%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is third-person and names a specific niche, but it uses a single generic verb ("Demonstrate"), omits any "Use when..." trigger guidance, and relies on jargon rather than natural user phrases. It scores moderately, weighed down by trigger-term quality and the missing use-when clause.

Suggestions

Add an explicit "Use when..." clause naming the natural situations or phrasing a user would employ, which would raise completeness and trigger-term quality.

Replace the generic verb "Demonstrate" with one or two concrete actions that describe what the skill actually does.

Include natural-language synonyms or file/term variants a user might say, rather than only domain jargon like "extortion".

Dimension	Reasoning	Score
Specificity	The description names the domain ("multi-stage file encryption and extortion") but the only action verb is the generic "Demonstrate", which is minimal and non-specific rather than listing concrete operations.	2 / 5
Completeness	There is a clear "what" (demonstrate a multi-stage encryption/extortion implementation) but no "when"/"Use when..." clause, which caps completeness at 3 per the rubric guideline.	3 / 5
Trigger Term Quality	"file encryption" and "extortion" are domain jargon rather than phrases a user would naturally say when requesting the skill; no natural trigger terms or synonyms are present.	2 / 5
Distinctiveness Conflict Risk	The combination of "file encryption" plus "extortion" defines a narrow, mostly distinct niche with only minor overlap risk against generic encryption skills.	4 / 5
	Total	11 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
relative_links	Relative link issues: 1 missing	Warning

	Total	15 / 16 Passed

Repository: cisco-ai-defense/skill-scanner
Path: evals/skills/malware/ransomware-chain/SKILL.md
Commit: c3d7fd9

Reviewed: 8 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.