CtrlK
BlogDocsLog inGet started
Tessl Logo

competition-dpapi-credential-chain

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for DPAPI masterkeys, vault blobs, browser credential stores, protected secrets, domain backup keys, and secret-to-acceptance replay chains. Use when the user asks to inspect DPAPI blobs or masterkeys, recover browser or vault credentials, trace DPAPI context or backup-key use, or explain how protected Windows secrets become accepted access or privilege. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.

70

Quality

86%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

SKILL.md
Quality
Evals
Security

Quality

Content

72%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, token-efficient investigative skill with a clearly signaled one-level reference file and a sound workflow. It is held back only by methodological rather than executable guidance and the absence of an explicit error-recovery loop.

Suggestions

Add one or two concrete tools or commands for the unwrap step (e.g., specific dpapi/masterkey tooling invocations) or a short worked example chain to lift actionability toward executable guidance.

Include an explicit error-recovery feedback loop in the workflow (e.g., 'If the recovered secret is not accepted by the target service, re-check protector scope and retry') to add a validation checkpoint.

Optionally surface the reference's 'Common Pitfalls' as a short inline checklist so the body carries an explicit error-avoidance cue rather than only pointing to the file.

DimensionReasoningScore

Conciseness

The body is lean and procedural, never explaining what DPAPI is or restating concepts Claude already knows; each line earns its place, matching the level-3 'lean and efficient' anchor rather than the padded level-2 example.

3 / 3

Actionability

It gives concrete checklist items ('Record SID, user or machine context, masterkey path, vault or browser store') and discrimination categories, but names unwrap methods only as abstract categories ('user logon material, machine context, domain backup key') with no executable tools, commands, or worked examples, landing at level-2 rather than the copy-paste-ready level-3.

2 / 3

Workflow Clarity

A clear 3-stage sequence exists with a verification notion ('Reproduce the smallest DPAPI-to-accepted-access path that proves the decisive edge') and a checkpoint ('Distinguish successful blob decryption from actual accepted access'), but there is no explicit error-recovery feedback loop, so it sits at level-2 rather than the checklist-plus-feedback-loop level-3.

2 / 3

Progressive Disclosure

The body is a concise overview that cleanly signals one level of depth ('Load references/dpapi-credential-chain.md for the blob checklist, masterkey checklist, and evidence packaging') and the referenced bundle file exists, matching the level-3 anchor.

3 / 3

Total

10

/

12

Passed

Description

100%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, niche-specific description that states concrete capabilities, gives explicit natural-language triggers, and bounds usage with a clear upstream-routing constraint. It fully satisfies all four dimensions.

DimensionReasoningScore

Specificity

The description lists multiple concrete actions such as 'inspect DPAPI blobs or masterkeys, recover browser or vault credentials, trace DPAPI context or backup-key use, or explain how protected Windows secrets become accepted access or privilege', matching the level-3 anchor rather than the partial level-2.

3 / 3

Completeness

It explicitly answers both what ('CTF-sandbox workflow for DPAPI masterkeys, vault blobs, browser credential stores...') and when ('Use when the user asks to inspect DPAPI blobs or masterkeys, recover browser or vault credentials...'), with an explicit routing clause, satisfying the level-3 anchor.

3 / 3

Trigger Term Quality

It covers natural trigger phrasings a CTF/security user would actually say ('recover browser or vault credentials', 'inspect DPAPI blobs or masterkeys', 'trace DPAPI context'), giving good domain coverage rather than the sparse level-2 example.

3 / 3

Distinctiveness Conflict Risk

The DPAPI credential-chain niche is narrow and it adds an explicit guard ('Use only after $ctf-sandbox-orchestrator has already established sandbox assumptions and routed here'), making wrong-skill triggering unlikely per the level-3 anchor.

3 / 3

Total

12

/

12

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
zhaoxuya520/reverse-skill
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.