CtrlK
BlogDocsLog inGet started
Tessl Logo

redteam-mindset

Red-team operator discipline — the mindset corrections that separate offensive testing from defensive WAPT. Built from authorized red-team work where conservative defaults caused multiple findings to be missed and one to be incorrectly retracted. Use at the START of any red-team engagement and again whenever feeling stuck or considering "stopping" on a defended target. The single most important skill to load when scope is "external red team" not "bug bounty / WAPT".

68

Quality

83%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

SKILL.md
Quality
Evals
Security

Quality

Content

77%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-sequenced mindset skill whose main weaknesses are cross-section repetition (conciseness) and the absence of any progressive-disclosure split into reference files for its large inline checklists and decision trees.

Suggestions

Collapse the repeated 'don't insert AskUserQuestion mid-loop' / 'authorization covers the engagement' guidance into a single canonical statement; the 'When to stop' and 'Anti-patterns' sections currently restate the primary directive verbatim.

Move the long per-host cadence checklist, blocker decision trees, and cross-validation table into reference files (e.g. references/cadence.md, references/blocker-decision-trees.md) and link to them from a leaner SKILL.md overview.

Tighten the self-throttling anti-patterns list so each item states a distinct failure mode once; items #1 and #9 currently describe the same mid-loop AskUserQuestion failure.

DimensionReasoningScore

Conciseness

The bulk is genuinely non-obvious operator knowledge rather than concepts Claude already knows, but several directives are restated 3–4 times across sections — 'don't insert AskUserQuestion mid-loop' (primary directive + anti-patterns #1 and #9), 'authorization covers the whole engagement' (primary directive + #9 + 'When to stop'), and 'skill-gap-as-stop-condition' (#10 + 'When to stop') — so it could be tightened. It is not score-1 because it is not explaining Claude-known concepts, but the repetition keeps it below a lean score-3.

2 / 3

Actionability

For an instruction-only skill it is exceptionally concrete: named payloads (alg=none JWT, audience confusion, 12 SQLi classes), install commands ('brew install jadx', 'apkpure direct download'), named services (2captcha, anti-captcha), and a copy-paste-ready JSONL engagement-journal example — guidance that is directly executable rather than abstract.

3 / 3

Workflow Clarity

Sequencing is explicit via pre/during/post-engagement checklists and a per-host cadence list with a hard completion gate ('If you've done less than this per host, you have not finished the host'), plus blocker decision trees that function as validate→retry feedback loops and a 2+-technique cross-validation requirement.

3 / 3

Progressive Disclosure

Sections are clearly headed and cross-skill pointers ('Bridge to neighboring skills', 'Related Skills & Chains') are well signaled, but this is a ~400-line monolithic SKILL.md with no bundle files and the cadence checklist, blocker decision trees, and cross-validation table are inline content that could plausibly live in separate reference files.

2 / 3

Total

10

/

12

Passed

Description

90%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A specific, well-triggered, distinctive description that clearly answers both what the skill does and when to load it, with only mild loss on action-list specificity.

DimensionReasoningScore

Specificity

Names the domain ('red-team operator discipline') and the core action ('the mindset corrections that separate offensive testing from defensive WAPT'), but does not enumerate multiple concrete actions the way the score-3 anchor ('Extract text and tables, fill forms, merge documents') does; it stays at the discipline/mindset abstraction level.

2 / 3

Completeness

It explicitly answers both 'what' ('mindset corrections that separate offensive testing from defensive WAPT') and 'when' ('Use at the START of any red-team engagement and again whenever feeling stuck or considering "stopping"'), satisfying the explicit-trigger requirement that would otherwise cap completeness at 2.

3 / 3

Trigger Term Quality

Phrases like 'red-team engagement', 'feeling stuck or considering "stopping"', 'defended target', 'external red team', and 'bug bounty / WAPT' are natural terms an authorized red-team operator would actually say when reaching for this skill.

3 / 3

Distinctiveness Conflict Risk

It explicitly carves its niche away from adjacent skills — 'The single most important skill to load when scope is "external red team" not "bug bounty / WAPT"' — making overlap with neighboring pentest/bug-bounty skills unlikely.

3 / 3

Total

11

/

12

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository
elementalsouls/Claude-BugHunter
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.