smtp-penetration-testing

This skill should be used when the user asks to "perform SMTP penetration testing", "enumerate email users", "test for open mail relays", "grab SMTP banners", "brute force email credentials", or "assess mail server security". It provides comprehensive techniques for testing SMTP server security.

Quality

78%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./skills/smtp-penetration-testing/SKILL.md

Quality

Content

65%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

Highly actionable and well-sequenced, but verbose through conceptual padding and duplicated command listings, and it makes no use of progressive disclosure — everything is inlined into one large SKILL.md. Risky/batch phases also lack validation checkpoints.

Suggestions

Move the worked Examples, Troubleshooting table, and Security Recommendations into a separate reference file referenced one level deep, and drop the conceptual Phase 1 architecture and 'Required Knowledge' list that Claude already knows.

De-duplicate the Quick Reference command/tool tables against the per-phase commands so each command appears once.

Add explicit validation checkpoints before the risky/batch phases — e.g., verify written authorization and confirm the target scope before brute-force (Phase 7) and open-relay exploitation (Phase 6), with a verify-and-stop loop if a test succeeds.

Dimension	Reasoning	Score
Conciseness	The body is mostly actionable command reference, but pads with concepts Claude already knows (Phase 1 MTA/MDA/MUA architecture, a 'Required Knowledge' list of SMTP/DNS fundamentals) and duplicates phase commands in the three worked Examples and Quick Reference tables.	3 / 5
Actionability	Every phase gives copy-paste-ready, executable commands (nmap, nc, telnet, hydra, smtp-user-enum, openssl, dig, Metasploit modules) with realistic placeholders, covering the common SMTP assessment cases.	5 / 5
Workflow Clarity	The ten phases are clearly sequenced, but batch/risky operations (brute force, open-relay exploitation sending to external domains) lack explicit validation checkpoints or authorization-verification gates, which caps this dimension at 3 per the rubric.	3 / 5
Progressive Disclosure	The file is well-sectioned with headers and tables, but it is a single ~500-line monolith with no bundle/reference files; detailed Examples, Troubleshooting, and Security Recommendations that could live one level deep are all inlined.	3 / 5
	Total	14 / 20 Passed

Description

91%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, trigger-rich description that clearly signals both scope and activation conditions in third person. The only soft spot is the 'what' clause being mildly generic relative to the concrete actions listed in the triggers.

Dimension	Reasoning	Score
Specificity	Enumerates six concrete actions — 'enumerate email users', 'test for open mail relays', 'grab SMTP banners', 'brute force email credentials', 'assess mail server security' — giving comprehensive coverage of the SMTP pentest domain rather than vague language.	5 / 5
Completeness	It explicitly answers 'when' via a concrete 'should be used when the user asks to...' clause with six triggers, and 'what' via 'comprehensive techniques for testing SMTP server security'; the 'what' sentence is slightly more generic than the 5 anchor's action list, so it sits just below 5.	4 / 5
Trigger Term Quality	Phrases like 'perform SMTP penetration testing', 'test for open mail relays', and 'brute force email credentials' are natural terms a user would actually say, with good synonym coverage across the enumeration/relay/auth surface.	5 / 5
Distinctiveness Conflict Risk	The SMTP-penetration-testing niche with mail-relay/banner/credential triggers is clearly distinguishable from other skills and unlikely to fire for the wrong skill.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (501 lines); consider splitting into references/ and linking	Warning

	Total	15 / 16 Passed

Repository: zebbern/claude-code-guide
Path: skills/smtp-penetration-testing/SKILL.md
Commit: 9d252b3

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.